// sigma convert -t kusto -p sentinel_asim, generated 11 Nov 2026. NOT run against a live tenant.
// ===== proxy_quay_keyserver_put_delete.yml (-p sentinel_asim)
imWebSession
| where Url contains "/keys/services/" and (HttpRequestMethod in~ ("PUT", "DELETE"))

// ===== proxy_quay_v2auth_url_audience.yml (-p sentinel_asim)
imWebSession
| where Url contains "/v2/auth" and ((Url contains "service=http://" or Url contains "service=https://" or Url contains "service=http%3A" or Url contains "service=https%3A") or (Url contains "service=http://" or Url contains "service=https://" or Url contains "service=http%3A" or Url contains "service=https%3A"))

// ===== web_quay_keyserver_access.yml (-p sentinel_asim)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

// ===== web_quay_keyserver_put_delete.yml (-p sentinel_asim)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

// ===== web_quay_v2auth_url_audience.yml (-p sentinel_asim)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt in kql/ instead.

