Agent skill · security · aradotso
dalonso-security-repo
Microsoft Security threat hunting queries, KQL examples, Sentinel workbooks, and security analytics notebooks
Why this skill is useful
Provides specific KQL queries and workflows for threat detection that the AI wouldn't reliably generate on its own.
What it needs
Requires azure-identity, azure-monitor-query, jupyter, msticpy, pandas installed locally. About 5k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
Dalonso Security Repo Skill by ara.so — Security Skills collection. A comprehensive collection of Microsoft Security resources including KQL queries, threat hunting use cases, Microsoft Sentinel workbooks, and Jupyter notebooks for security analytics and investigation workflows. What This Repository Provides The Dalonso Security Repo is a curated knowledge base for Microsoft Security technologies: Threat Hunting Use Cases: Real-world KQL (Kusto Query Language) queries for proactive threat detection Microsoft Sentinel Workbooks: Custom visualization and analysis dashboards Security Analytics Notebooks: Jupyter notebooks for advanced investigation and automation Practical Examples: Production-ready queries and workflows for security operations Installation Clone the repository to access all resources: For Jupyter notebooks, install required dependencies: Repository Structure The repository is organized by security tool and use case: Working with KQL Queries Basic KQL Query Structure KQL queries in this repo follow standard Microsoft Sentinel/Log Analytics syntax: Using Queries in Microsoft Sentinel 1. Navigate to Microsoft Sentinel > Logs 2. Copy the KQL query from the repository 3. Paste into the query editor 4. Adjust time ranges and parameters as needed 5. Run and analyze results Threat Hunting Query Pattern Working with Sentinel Workbooks Importing a Workbook 1. Download the workbook JSON file from the repository 2. In Microsoft Sentinel > Workbooks > Add workbook 3. Click Edit > Advanced Editor (</> icon) 4. Replace content with the downloaded JSON 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/dalonso-security-repo