init

Author: LasCC

.github/workflows/ci.yml

@@ -0,0 +1,61 @@
+name: Build & Release
+
+on:
+  push:
+    branches: [master]
+
+permissions:
+  contents: write
+
+jobs:
+  build-and-release:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - run: npm ci
+
+      - name: Typecheck
+        run: npx tsc --noEmit
+
+      - name: Build
+        run: npm run build
+
+      - name: Verify userscript header
+        run: head -1 dist/sentinel-userscript.user.js | grep -q '// ==UserScript=='
+
+      - name: Generate release tag
+        id: tag
+        run: |
+          TAG="build-$(date -u +'%Y.%m.%d-%H%M%S')"
+          echo "TAG=$TAG" >> "$GITHUB_OUTPUT"
+          echo "DATE=$(date -u +'%B %d, %Y at %H:%M:%S UTC')" >> "$GITHUB_OUTPUT"
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ steps.tag.outputs.TAG }}
+          name: Build - ${{ steps.tag.outputs.DATE }}
+          body: |
+            ## Microsoft Sentinel & Defender: Threat Hunting Queries
+
+            **Built from** `${{ github.sha }}` on ${{ steps.tag.outputs.DATE }}
+
+            ### Installation
+            1. Install [Tampermonkey](https://www.tampermonkey.net/) in your browser
+            2. Click **sentinel-userscript.user.js** below to auto-install in Tampermonkey
+            3. Open Tampermonkey dashboard → Utilities → Import from file
+            4. Select the downloaded `.js` file
+
+            Or install directly from the raw URL:
+            ```
+            https://github.com/${{ github.repository }}/releases/download/${{ steps.tag.outputs.TAG }}/sentinel-userscript.user.js
+            ```
+          files: dist/sentinel-userscript.user.js
+          generate_release_notes: true

.gitignore

@@ -0,0 +1,5 @@
+node_modules/
+dist/
+*.png
+!docs/*.png
+.DS_Store

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ludovic COULON
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,49 @@
+# Microsoft Sentinel & Defender: Threat Hunting Queries
+
+Tampermonkey userscript that adds a threat hunting query menu to **Microsoft Sentinel** and **Microsoft Defender** Advanced Hunting pages.
+
+Browse, search, pin, and inject KQL queries directly into the Monaco editor.
+
+## Screenshots
+
+| Defender (dark mode) | Sentinel | Sentinel (popup) |
+|---|---|---|
+| ![Defender](docs/defender-dark.png) | ![Sentinel](docs/sentinel-button.png) | ![Popup](docs/sentinel-popup.png) |
+
+## Features
+
+- Inline "Threat Hunting Queries" button in the command bar
+- Tabs: **User Rules** (bundled), **Reprise99**, **Bert-JanP** (fetched from GitHub)
+- Search across query name, description, category, and KQL content
+- Pin queries for quick access (horizontal pill bar above results)
+- Click any query row to inject it into the editor
+- Works in both Sentinel (reactblade iframe) and Defender (security.microsoft.com)
+- Light/dark theme support via Azure Portal CSS variables
+
+## Install
+
+1. Install [Tampermonkey](https://www.tampermonkey.net/)
+2. Click **[Install Userscript](https://raw.githubusercontent.com/LasCC/MicrosoftSentinel-Userscript/main/dist/sentinel-userscript.user.js)** (auto-installs in Tampermonkey)
+3. Navigate to Advanced Hunting in Sentinel or Defender
+
+## Public Rule Sources
+
+| Repo | Queries | Format |
+|------|---------|--------|
+| [reprise99/Sentinel-Queries](https://github.com/reprise99/Sentinel-Queries) | ~460 | `.kql` files |
+| [Bert-JanP/Hunting-Queries-Detection-Rules](https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules) | ~445 | `.md` with fenced KQL |
+
+Rules are fetched lazily on first tab click, cached locally for 1 hour.
+
+## Build
+
+```
+npm install
+npm run build
+```
+
+Output: `dist/sentinel-userscript.user.js`
+
+## Related
+
+- [SentinelOne Userscript](https://github.com/LasCC/SentinelOne-Userscript) - Similar project for SentinelOne