This repository is part of my contributions as a Microsoft Learn Student Ambassador, focused on Security, SIEM, and XDR. It contains ready-to-use resources for the community:
✅ Microsoft Sentinel KQL queries (threat hunting, detections, dashboards)
✅ Sentinel playbooks (Logic Apps for automated response)
✅ Defender XDR lab scenarios and scripts
✅ Identity security (Entra ID Conditional Access, governance)
✅ Custom Integrations with Logic App
The goal is to help students, IT professionals, and Ambassadors learn and apply Microsoft Security technologies in real-world scenarios.
📂 Repository Structure
/Logic Apps ├─ Auth0 ├─ Juniper Mist
/KQL-Queries ├─ InsiderThreat.kql ├─ DataExfiltration.kql
/Playbooks ├─ Auto-Isolate-Device.json ├─ Alert-to-Teams.json
/XDR-Labs ├─ Lab1-Detecting-Phishing.md ├─ Lab2-Incident-Response.md
/Identity-Governance ├─ ConditionalAccess-Security-Baseline.json ├─ Entra-ID-Governance-Guide.md
Import KQL queries into Microsoft Sentinel.
Deploy Playbooks via Logic Apps Designer.
Try out XDR lab scenarios in your test/education environment.
⚠️ Note: These resources are for learning and community contribution purposes. Always test in a non-production environment first.
Learn how to build detections in Microsoft Sentinel.
Automate response with Logic Apps and Defender XDR.
Strengthen identity security with Entra ID governance.
Share and reuse resources across the Student Ambassador community.
###👩💻 Contributions
This is an open community repo. Contributions are welcome!
Fork the repo and submit a Pull Request.
Share your own KQL queries, playbooks, or labs.
Add feedback/issues under the Issues tab.
This repo is part of my journey as a Microsoft Learn Student Ambassador (MLSA).
Used in workshops, study groups, and mentoring sessions.
Open-source contributions for the global security community.
Supports my MVP-aligned focus on SIEM & XDR.
LinkedIn: www.linkedin.com/in/konstantinos-lianos
MLSA Profile: https://mvp.microsoft.com/en-US/studentambassadors/profile/465de247-7528-42e1-8033-f00269bfc711