// sigma convert -t kusto --without-pipeline, generated 11 Nov 2026. NOT run against a live tenant.
// ===== proxy_quay_robot_listing_underscore_org.yml (--without-pipeline)
'cs-method' =~ "GET" and 'c-uri' matches regex "/api/v1/organization/[a-z0-9.-]*_[a-z0-9._-]*/robots/?(\\?|$)"

// ===== proxy_quay_underscore_namespace_rename_delete.yml (--without-pipeline)
('cs-method' in~ ("PUT", "DELETE")) and 'c-uri' matches regex "/api/v1/(organization|superuser/organizations|superuser/users)/[a-z0-9.-]*_[a-z0-9._-]*/?(\\?|$)"

// ===== web_quay_robot_listing_underscore_org.yml (--without-pipeline)
'cs-method' =~ "GET" and 'cs-uri-stem' matches regex "^/api/v1/organization/[a-z0-9.-]*_[a-z0-9._-]*/robots/?$"

// ===== web_quay_robot_listing_with_tokens.yml (--without-pipeline)
('cs-method' =~ "GET" and 'cs-uri-stem' matches regex "^/api/v1/(organization/[a-z0-9._-]+|user)/robots/?$") and (not('cs-uri-query' contains "token=false"))

// ===== web_quay_underscore_namespace_rename_delete.yml (--without-pipeline)
('cs-method' in~ ("PUT", "DELETE")) and 'cs-uri-stem' matches regex "^/api/v1/(organization|superuser/organizations|superuser/users)/[a-z0-9.-]*_[a-z0-9._-]*/?$"

