microsoft-sentinel
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a reference guide for security analysts to author KQL (Kusto Query Language) for Microsoft Sentinel. It includes schemas, query patterns for common attack techniques (MITRE ATT&CK), and false-positive reduction strategies.
- [SAFE]: KQL templates provided use standard Sentinel tables (SigninLogs, AuditLogs, AzureActivity, etc.) and follow best practices for performance and accuracy.
- [SAFE]: The skill uses placeholder values (e.g., '', '') for environment-specific configuration, avoiding hardcoded credentials or sensitive data.
- [SAFE]: No network operations, external downloads, or dynamic code execution patterns were identified in the instructions or scripts.
Audit Metadata