Featured
PIM Auditing in Microsoft Sentinel: High Value Detections
Why Abandoned Resources Are a Security Problem, Not Just a Billing One
Sentinel Incident Email Alerts: Free Logic App with ARM Template
Advanced Hunting Just Got a Lot More Powerful. You Can Now Act on What You Find.
The Nag Machine: A Logic App That Badgers Your Team About Unowned Sentinel Incidents
Your Crown Jewels Are in Defender. You Just Never Set Them Up.
Building Your First Threat Hunting Hypothesis (The MITRE Way)
Diagnostic Settings Manager Workbook
Azure Key Vault: The High-Value Queries Your SOC Isn't Running
Hunting PowerShell Abuse in MDE: Eight Queries, Real Results
I Passed the GCDA. Here's What Nobody Tells You About SEC555
Your Sentinel Detection Setup Is Probably Broken. Here's How to Know.
Defender XDR Incident Investigation: A to Z Using a Real Example
Evaluating and Onboarding a Microsoft MSSP (Without the Chaos)
Choosing a Microsoft MSSP Without Getting Burned (SOC/SIEM)
Conditional Access Health Check: What Your Policies Actually Do
Detection Engineering and Why It's a Must Have Part 2
Detection Engineering and Why It's a Must Have
One‑Click Threat Intel: Add IOCs from Sentinel Incidents with a Logic App
Advanced Hunting
-
Building a Brute Force Detection Query: How To Think Through Network Logon Failures
-
Defender XDR Incident Investigation: A to Z Using a Real Example
-
Advanced Hunting Just Got a Lot More Powerful. You Can Now Act on What You Find.
Analytic Rules
-
Microsoft Sentinel: From Logs to Alerts - Creating Your First Analytic Rule
-
How to Bulk Enable All Sentinel Analytic Rules (The Easy Way)
-
Beyond the Basics: Forging Your Own Custom Detections in Defender XDR
-
The KQL Playbook (Play #2): Mastering the Matching Game
-
Fixing Microsoft's Azure Brute Force Detection: Why Their Template Fires Constantly (And What You Should Change)
Automation
-
Microsoft Sentinel: Let the Robots Do the Work - Your First Automation Playbook
-
How to Bulk Enable All Sentinel Analytic Rules (The Easy Way)
-
Microsoft Sentinel: How to Nuke a Noisy Incident Queue
-
Microsoft Sentinel Rule Tuning: Kick the Noise, Keep the Signal
-
Herding Cats with Sentinel: An In-Depth Guide to Workspace Manager
Career Advice
-
How to Nail Your First SOC Analyst Interview (Professor's Notes)
-
MSSP SOC Analyst Interviews (Microsoft Stack): The questions you’ll actually get -and the answers I’d actually give
Cost Optimisation
-
Sentinel on a Budget: How to Tame Your Log Costs
-
Sentinel's Endgame Gear: Sentinel Data Lake
-
Sentinel's Built-in Consultant: An In-Depth Guide to SOC Optimization
-
The "Undo" Button for Sentinel Logs: An In-Depth Guide to Purging Data
-
Post-Deployment Sentinel and Defender XDR: You're Not Done Yet
Data Connectors
-
So You've Deployed Sentinel. Now What? A Guide to Data Connectors
-
Post-Deployment Sentinel and Defender XDR: You're Not Done Yet
-
Data Connectors: The Order That Actually Matters
Defender XDR
-
Post-Deployment Sentinel and Defender XDR: You're Not Done Yet
-
Defender for Office 365 Policy Configuration: Anti-Phishing, Anti-Spam, Malware, Safe Links
-
Threat Analytics in Microsoft Defender: What It Actually Does and Why Your SOC Needs It
-
Data Connectors: The Order That Actually Matters
-
Defender for Identity: What's The Point? (And Is It Actually Worth Your Time)
Detection Engineering
-
Detection Engineering and Why It's a Must Have
-
Detection Engineering and Why It's a Must Have Part 2
-
Your Sentinel Detection Setup Is Probably Broken. Here's How to Know.
-
I Passed the GCDA. Here's What Nobody Tells You About SEC555
-
Your Crown Jewels Are in Defender. You Just Never Set Them Up.
Getting Started
-
How to create Microsoft Sentinel
-
So You've Deployed Sentinel. Now What? A Guide to Data Connectors
-
Microsoft Sentinel: From Logs to Alerts - Creating Your First Analytic Rule
-
Microsoft Sentinel: An Incident Just Fired. Now What? (A Beginner's Guide to Investigation)
-
The KQL Playbook (Play #2): Mastering the Matching Game
Incident Investigation
Incident Response
-
Microsoft Sentinel: An Incident Just Fired. Now What? (A Beginner's Guide to Investigation)
-
Microsoft Threat Intelligence: Giving Your Sentinel a Brain
-
Hunting Ransomware in Storage Accounts (When You Can't Afford Defender)
-
Beyond the Basics: Forging Your Own Custom Detections in Defender XDR
-
Defender XDR Incident Investigation: A to Z Using a Real Example
KQL
-
Microsoft Sentinel: From Logs to Alerts - Creating Your First Analytic Rule
-
Microsoft Sentinel: An Incident Just Fired. Now What? (A Beginner's Guide to Investigation)
-
The KQL Playbook (Play #1): A Beginner's Guide to Talking to Your Data
-
Microsoft Sentinel's Secret Weapon: Your First Watchlist
-
Microsoft Sentinel Rule Tuning: Kick the Noise, Keep the Signal
Logic Apps
-
Microsoft Sentinel: Let the Robots Do the Work - Your First Automation Playbook
-
The "Undo" Button for Sentinel Logs: An In-Depth Guide to Purging Data
-
The Self-Updating Watchlist: Automating Sentinel with Logic Apps & Graph API
-
Sentinel Cost Spike: How To Actually Find The Culprit Table
-
One‑Click Threat Intel: Add IOCs from Sentinel Incidents with a Logic App
Microsoft Defender for Cloud Apps
-
A SOC Analyst's Introduction to Defender for Cloud Apps
-
Mastering Policies in Defender for Cloud Apps: A Deep Dive for the SOC Trenches
-
App Governance in Defender for Cloud Apps: Your OAuth App Security Command Centre
-
Why You Actually Need Microsoft Defender for Cloud (And What It Actually Does)
-
Connecting Your Environment to Defender for Cloud: Azure, AWS, GCP, and On-Premises
Microsoft Sentinel
-
How to create Microsoft Sentinel
-
A Day in the Life of a SOC Analyst
-
So You've Deployed Sentinel. Now What? A Guide to Data Connectors
-
Microsoft Sentinel: From Logs to Alerts - Creating Your First Analytic Rule
-
Microsoft Sentinel: An Incident Just Fired. Now What? (A Beginner's Guide to Investigation)
Security Operations
-
A Day in the Life of a SOC Analyst
-
Microsoft Sentinel: How to Nuke a Noisy Incident Queue
-
MSSP SOC Analyst Interviews (Microsoft Stack): The questions you’ll actually get -and the answers I’d actually give
-
The KQL Playbook (Play #2): Mastering the Matching Game
-
The KQL Playbook (Play #5): The Anomaly Play - Finding the 'Weird'
Sentinel Tuning
-
Post-Deployment Sentinel and Defender XDR: You're Not Done Yet
-
Beauty of Data Visualization in Microsoft Sentinel Using KQL
-
Microsoft Sentinel on a Shoestring: What You Can Actually Do with Business Premium
Sentinel Workbook
-
Sentinel Workbooks: Deploy and Customise Your First Dashboard
-
Three Essential Sentinel Workbooks You Should Deploy Right Now
-
User Audit Investigation Workbook: Deploy in Minutes, Investigate in Seconds
-
Diagnostic Settings Manager Workbook
-
Why Abandoned Resources Are a Security Problem, Not Just a Billing One
Shadow IT
-
A SOC Analyst's Introduction to Defender for Cloud Apps
-
App Governance in Defender for Cloud Apps: Your OAuth App Security Command Centre
SOC
-
How to Nail Your First SOC Analyst Interview (Professor's Notes)
-
A Day in the Life of a SOC Analyst
-
Microsoft Sentinel: How to Nuke a Noisy Incident Queue
-
MSSP SOC Analyst Interviews (Microsoft Stack): The questions you’ll actually get -and the answers I’d actually give
-
Microsoft Threat Intelligence: Giving Your Sentinel a Brain
Threat Hunting
-
The KQL Playbook (Play #1): A Beginner's Guide to Talking to Your Data
-
Sentinel's Endgame Gear: Sentinel Data Lake
-
Microsoft Threat Intelligence: Giving Your Sentinel a Brain
-
Hunting Ransomware in Storage Accounts (When You Can't Afford Defender)
-
The KQL Playbook (Play #3): Mastering Strings, Timestamps, and Ugly JSON
UEBA
-
UEBA in Microsoft Sentinel: Stop Wasting Time on Behavioral Analytics
-
Your Sentinel Detection Setup Is Probably Broken. Here's How to Know.
Workbooks
-
Sentinel Workbooks: Deploy and Customise Your First Dashboard
-
Three Essential Sentinel Workbooks You Should Deploy Right Now
-
User Audit Investigation Workbook: Deploy in Minutes, Investigate in Seconds
-
Diagnostic Settings Manager Workbook
-
Why Abandoned Resources Are a Security Problem, Not Just a Billing One