kql-mde-xdr

Write and optimize KQL queries for MDE, Sentinel, and Defender XDR.

4|Updated Jan 21, 2026

Search Tags:#query-optimization #detection-engineering #threat-hunting #incident-investigation #kql #defender #mde

Ready to run

npx skills add https://github.com/audibleblink/skills --skill kql-mde-xdr

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: kql-mde-xdr
Source: https://github.com/audibleblink/skills/tree/main/kql-mde-xdr
Command: npx skills add https://github.com/audibleblink/skills --skill kql-mde-xdr

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

KQL queries for Microsoft Defender for Endpoint (MDE), Microsoft Sentinel, and Defender for Microsoft 365 Defender XDR are often complex, error-prone, and slow to write, making threat hunting and incident investigations tedious and error-prone.

Core Features & Use Cases

Write and optimize KQL queries across MDE, Sentinel, and M365 Defender XDR to improve detection analytics.
Validate field schemas and reference tables from the references directory before constructing queries to ensure accuracy.
Use cases include threat hunting, detection engineering, and incident investigations across Defender products, with guidance for performance and readability.

Quick Start

Craft a minimal KQL query against DeviceInfo to validate schema and syntax, then run it to confirm results.

Frequently Asked Questions about kql-mde-xdr

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I write optimized KQL queries for Microsoft Defender XDR threat hunting?▼

To write optimized KQL queries for Defender XDR, you must validate field schemas against reference tables before query construction. This ensures accuracy and follows performance best practices for threat hunting and incident investigation.

What is the best way to validate KQL field schemas for MDE detection engineering?▼

The best way to validate KQL field schemas for MDE is to check the reference tables in the references directory before constructing queries. You can craft a minimal query against DeviceInfo to validate schema and syntax.

Does this approach support writing detection rules across both Microsoft Sentinel and M365 Defender?▼

Yes, this approach supports writing and optimizing KQL detection rules across Microsoft Sentinel, MDE, and M365 Defender XDR. It applies reference table validation and performance guidance to all Microsoft Defender products.

How do I optimize slow KQL queries during incident investigation?▼

You optimize slow KQL queries during incident investigation by following best-practice guidance for performance and readability. Validating reference tables and field schemas before construction prevents errors and improves query efficiency.

Why do my KQL threat hunting queries fail due to schema errors?▼

KQL threat hunting queries fail when field schemas are not validated against reference tables before construction. Verifying the schema accuracy in the references directory beforehand prevents these syntax and field mapping errors.

Can I use this method to improve detection analytics for Defender for Endpoint?▼

Yes, you can use this method to improve detection analytics for Defender for Endpoint. It specifically targets writing and optimizing KQL queries to enhance threat hunting and detection engineering across MDE environments.