// sigma convert -t kusto -p sentinel_asim, generated 11 Nov 2026. NOT run against a live tenant.
// ===== proxy_quay_robot_listing_underscore_org.yml (-p sentinel_asim)
imWebSession
| where HttpRequestMethod =~ "GET" and Url matches regex "/api/v1/organization/[a-z0-9.-]*_[a-z0-9._-]*/robots/?(\\?|$)"

// ===== proxy_quay_underscore_namespace_rename_delete.yml (-p sentinel_asim)
imWebSession
| where (HttpRequestMethod in~ ("PUT", "DELETE")) and Url matches regex "/api/v1/(organization|superuser/organizations|superuser/users)/[a-z0-9.-]*_[a-z0-9._-]*/?(\\?|$)"

// ===== web_quay_robot_listing_underscore_org.yml (-p sentinel_asim)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

// ===== web_quay_robot_listing_with_tokens.yml (-p sentinel_asim)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

// ===== web_quay_underscore_namespace_rename_delete.yml (-p sentinel_asim)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

