Drag to spin him round. Click and he hops.
Microsoft security you can actually deploy.
Sentinel, Defender and KQL from someone who runs them for a living. Rules tuned for production, queries you can paste straight in, and the settings nobody told you about.
121 posts so far, and a new one most weeks.
Content hub rules, tuned for production.
The Fixing the Analytic Rule series takes one content hub rule at a time, explains what it's trying to catch, and tunes it to fire on what matters in a real tenant. 32 rules so far, each with a JSON you can import.
Read the series
73 queries. One search box.
The KQL Vault is free with a subscription. Search by name, table or MITRE ID, copy it, change the UPN at the top and run it. Analytic rules come with the JSON.
Unlock the vaultNot sure where to start?
Pick the one that sounds like you. Each path is five posts, in order.
-
I'm new to SentinelDeploy it properly, connect the data, write your first rule.
-
I work in a SOCTriage faster, investigate properly, start hunting.
-
I build the detectionsDetection engineering from methodology to rules you can deploy.
Latest posts
Older posts
Get the next post by email
One email per post, plus the KQL Vault. That's the whole deal.