Microsoft XDR Advanced Hunting Schema
To help with multi-table queries, you can use the advanced hunting schema, which includes tables and columns with event information and details about devices, alerts, identities, and other entity types.
- from
- Detection Engineering
- added
- 2026-10-10
- likes
- 0
similar
-
KQL Advanced Hunting Queries & Analytics Rules github.com
A list of endpoint detections and hunting queries for Microsoft Defender for Endpoint, Defender For Identity, and Defender For Cloud Apps.
-
Elastic Common Schema elastic.co
Elastic's proprietary model used as a framework for normalizing security data.
-
Teradata MDM teradata.co.uk
Establishes a consistent analytical foundation by maintaining accurate reference data for enhanced ROI.
-
Center for Threat Informed Defense Security Stack Mappings github.com
Describes cloud computing platform's (Azure, AWS) built-in detection capabilities and their mappings to the MITRE ATT&CK framework.
-
Aegis DQ github.com
Open-source agentic data quality framework with LLM-powered diagnosis, root-cause analysis, SQL auto-fix proposals, and 31 rule types — DuckDB, Postgres, BigQuery, Databricks, Athena, Snowflake.
-
Elastic elastic.co
State Of Detection Engineering (2025) - Analyzes the practice of detection engineering within Elastic Security, detailing their approach to rule development and enhancement. Key findings highlight the impact of real-world threat analysis, automated rule validation, and the…
Detection Engineering › Logging, Monitoring & Data Sources: “To help with multi-table queries, you can use the advanced hunting schema, which includes tables and columns with event information and details about devices, alerts, identities, and other entity types.”