// sigma convert -t kusto --without-pipeline, generated 11 Nov 2026. NOT run against a live tenant.
// ===== proxy_quay_keyserver_put_delete.yml (--without-pipeline)
'c-uri' contains "/keys/services/" and ('cs-method' in~ ("PUT", "DELETE"))

// ===== proxy_quay_v2auth_url_audience.yml (--without-pipeline)
'c-uri' contains "/v2/auth" and ((''c-uri'' contains "service=http://" or ''c-uri'' contains "service=https://" or ''c-uri'' contains "service=http%3A" or ''c-uri'' contains "service=https%3A") or (''c-uri-query'' contains "service=http://" or ''c-uri-query'' contains "service=https://" or ''c-uri-query'' contains "service=http%3A" or ''c-uri-query'' contains "service=https%3A"))

// ===== web_quay_keyserver_access.yml (--without-pipeline)
'cs-uri-stem' startswith "/keys/"

// ===== web_quay_keyserver_put_delete.yml (--without-pipeline)
'cs-uri-stem' startswith "/keys/services/" and ('cs-method' in~ ("PUT", "DELETE"))

// ===== web_quay_v2auth_url_audience.yml (--without-pipeline)
'cs-uri-stem' endswith "/v2/auth" and (''cs-uri-query'' contains "service=http://" or ''cs-uri-query'' contains "service=https://" or ''cs-uri-query'' contains "service=http%3A" or ''cs-uri-query'' contains "service=https%3A")

