Sentinel Novice
Level 1, new to Sentinel
Sentinel, Defender and KQL, without the boring bits.
Hands-on Microsoft security from someone who runs a SOC for a living. Real queries, tuned rules and an owl who has seen your incident queue.
123 posts so far, and a new one most weeks.
←→ move Space jump X fireball C frost V lightning
Choose your class
Pick the one that sounds like you. Each path is a questline: posts in order, each one unlocking the next.
SOC Analyst
Level 12, works in a SOC
Detection Engineer
Level 40, builds the detections
Latest posts
Older posts
Microsoft Sentinel
Fixing the "External user added and removed in short timeframe" Analytic Rule
Alright class. Today: External user added and removed in short timeframe, a content hub rule that watches Microsoft Teams for a guest being added to a
Microsoft Sentinel
Fixing the "Excessive Number of Failed Connections from a Single Source" Analytic Rule
Alright class. Today we pull apart "Excessive number of failed connections from a single source" from the Network Session Essentials solution. The YAML behind
KQL
Would You Know If Someone Cancelled Your Azure Subscription?
Alright class. Yet another lesson in this series, and this one breaks the format. There is no Microsoft rule to fix today, because Microsoft does not
Microsoft Sentinel
Fixing the "Application URL" Analytic Rules, All Three of Them
Alright class. Another lesson, first one fixing three rules at once. The content hub ships "Changes to Application Logout URL", "Application Redirect URL
KQL
Fixing the "Guest Users Invited to Tenant by New Inviters" Analytic Rule
Alright class. Today we are looking at "Guest Users Invited to Tenant by New Inviters", a content hub rule that promises to spot guest
KQL
Sentinel Table Transformations: Cut the Table, Keep the Detections
All right class Two lessons ago we found the spike. Here you learned how to walk the Usage table backwards until your data confesses. Sentinel Log
Microsoft Sentinel
Anyone With the Link
All right class. Somebody shared a file this week by picking the option at the top of the list. The one that says Anyone with the
KQL
The Guests Who Never Left
All right class. Every tenant has them. A guest invited in 2019 for a migration project that finished in 2020, invited by somebody who left in
KQL
The Antivirus Setting Your Admins Turned Off Years Ago
All right class. Somewhere in your estate there is a device with C:\ in its Defender exclusion list. Somebody put it there in 2021 to stopContent hub rules, tuned for production.
The Fixing the Analytic Rule series takes one content hub rule at a time, explains what it's trying to catch, and tunes it to fire on what matters in a real tenant. 34 rules so far, each with a JSON you can import.
Fixing the "External user added and removed in short timeframe" Analytic RuleDefeatedFixing the "Excessive Number of Failed Connections from a Single Source" Analytic RuleDefeatedWould You Know If Someone Cancelled Your Azure Subscription?Defeated- Next boss: coming soon In progress
73 queries. One search box.
The KQL Vault is free with a subscription. Search by name, table or MITRE ID, copy it, change the UPN at the top and run it. Analytic rules come with the JSON.
Unlock the vault
Save your progress
Get the next post by email
One email per post, plus the KQL Vault. That's the whole deal.