Observed arrival · 2026-10-01
Radarforge maps Sentinel rules to their data prerequisites
A catalog for Microsoft Sentinel detection rules that shows the tables and fields each rule requires, with filters for matching rules to data an operator already has.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- Microsoft Sentinel detection engineers
- Worth noticing
- A match requires fully analyzed rules; field values, types, parsers, query execution, and detection effectiveness still need separate validation.
Field notes
The catalog distinguishes a separately checked tool/log origin from solution context and declared connector IDs, which it treats as useful clues rather than full proof of data provenance. It also records functions and summary generators as dependencies instead of counting them as detection rules. The current scope is Sentinel and KQL; other named SIEM catalogs are explicitly marked as planned.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
✦PrettyNotable craft visible
●ProPolished or operationally mature
◎NicheUnusually specific use
One card from the complete issue