copilot-kql-library¶
A curated library of KQL queries for auditing, hunting, and reporting on Microsoft 365 Copilot.
What's here¶
- Audit queries - compliance-focused queries against the Microsoft Purview unified audit log.
- Hunting queries - Defender XDR / Sentinel queries for anomalous or risky Copilot use.
- Grounding queries - surface which files, sites, and data Copilot is grounding on.
Browse the navigation on the left. Source files (.kql) live in queries/ on GitHub, ready to paste into the relevant portal.
Where to run them¶
| Category | Portal |
|---|---|
| Audit | Microsoft Purview audit log search |
| Hunting | Microsoft Defender XDR Advanced Hunting |
| Hunting / Grounding | Microsoft Sentinel (any workspace with the Microsoft 365 connector) |