Where do you store your KQL queries?

[rod-trent]

I used to be a huge file packrat. I'd store years of files (PowerShell scripts, etc.) on the hard drive of each system I owned. When OneDrive became available, I would store them in both OneDrive and locally still - feeling like I needed that sort of redundancy.

But, with KQL, I've done a good job by utilizing several GitHub repositories instead. You might find a stray KQL query on my hard drive or in my personal or work OneDrive, but they are all now consolidated on GitHub.

What about you? What's your favorite place to store your KQL queries?

[ScottWhittier]

OneNote - need to move to GitHub?

[rod-trent]

Good old OneNote!

Your comment made me go look to see if I did, indeed, use OneNote for queries early on. I found two!

Just two, but yep -- they are there.

Here's the ones I found:

CommonSecurityLog
| where TimeGenerated > ago(60d)
| summarize count() by bin(TimeGenerated, 14d)
| extend Week = iff(TimeGenerated>ago(30d), "This Week", "Last Week"), TimeGenerated = iff(TimeGenerated>ago(30d), TimeGenerated, TimeGenerated + 30d)

SigninLogs
| summarize count() by bin(TimeGenerated, 1h)

[ScottWhittier]

I've practically lived in it for the last several years but maybe it's time to find a different space, esp. for KQL.

[ScottWhittier]

Okay, all of this being said, any guidance on how to get started with GitHub?

[rod-trent]

Good Q. I may have to write up some guideance and tools.

[ScottWhittier]

That would be great for a OneNote vet/GitHub noob like me. Thanks for all the great work!

[gaborkalmar83]

it goes in the following cycle for me:

1. private query pack ( testing/working/whatAmIGoingToDoWithThis? )
2. shared query pack ( someone else has/had the same question )
3. and then I try to bundle them in workbooks, based on same topic / resource type and it also offers great flexibility to bend the variables and make it more user friendly + also storing it in GitHub

[cybermohr]

I have started moving to GitHub for scripts including KQL. But I was mainly using OneDrive.