Python Libraries for Threat Detection Engineers

• I am not a Developer
• Detection Engineer who likes to apply python to my daily hunting and detection development
• My collection of threat detections

• Detection Logic Library
• Mostly KQL at the moment
• Detection logic stored in yaml format
• Organized a bit differently than other detection repos
• Detections are callable via python functions for hunting in a Jupyter NoteBooks or scripts
• Detect-as-Code or Detect-as-Config compatible

• Functions to connect to azure & other msft cloud services

• function to index my detections into a csv