Detection Queries for
Sentinel and Defender XDR

Tested and proven useful in real security operations.

Schema update AADSignInEventsBeta retired. Affected queries migrated to EntraIdSignInEvents and EntraIdDeviceId. Marked updated in the list. Read the advisory →

01 Browse by category

02 Explore differently

Submit Query Detailed Submit Feedback

GoXDR created by GoX

Categories 0

Showing0

Schema2026.07 ✓

Last auditJul 14

|

Pick a query from the list. Use ↑ ↓ to move, / to search.

ATT&CK coverage matrix

MITRE ATT&CK Enterprise tactics, mapped from query tags and content. Deeper blue means more detections in this library. Click any tactic column to filter workspace to that tactic.

No coverage

1-2 queries

3-5 queries

6+ queries

Early stage: recon, initial access, execution

Mid stage: persistence through lateral movement

Late stage: collection, C2, exfiltration, impact

Detection Queries for
Sentinel and Defender XDR

Coverage by tactic and technique

Three pane analyst view

Schema changes and deprecations

Community favorites

ATT&CK coverage matrix

Detection Queries forSentinel and Defender XDR

Coverage by tactic and technique

Three pane analyst view

Schema changes and deprecations

Community favorites

ATT&CK coverage matrix

Detection Queries for
Sentinel and Defender XDR