Welcome to IT Professor!

All right class.

IT Professor is where I write up Microsoft Sentinel, Defender and KQL the way I wish someone had written them up for me: tested in a real tenant, with the bits that break in production left in.

Who's the professor?

I'm Bart Wysocki (Bartosz, if you're filling in a form). I'm Head of Security Engineering at a UK MSSP, where my teams build the detections, automation and Power BI reporting behind a managed SOC running Sentinel and Defender across multiple tenants.

I didn't start there. I started as a SOC analyst, learning KQL one broken query at a time, then moved into security engineering, then spent a few years as a DevOps manager before landing here. I also run technical interviews for security engineering roles, so the career posts come from the side of the table that writes the scorecard.

Certifications, for anyone who scrolled straight to this bit: GIAC GCDA (SANS SEC555), SC-200, SC-300 and AZ-500 (+16 other certificates which are more boring) I've also written a novel in Polish, which explains the jokes.

What you'll find here

• Fixing the Analytic Rule. Microsoft's templates taken apart and rebuilt into rules you'd actually deploy.
• One feature per post. Something in Sentinel, Defender XDR or Entra that most tenants already have and nobody has switched on, explained so you can use it the same day.
• KQL you can paste. Every query runs in a real tenant before it goes up, and the KQL Vault keeps them all in one place.
• Free tools. Workbooks and Logic Apps with ARM templates, ready to deploy.
• Career stuff. Interview questions, certification tier lists and what actually gets people hired.

Almost everything here is free and stays that way. If you think I've got something wrong, tell me. Arguing about KQL is half the fun.

And the owl?

That's Profo. He turns up in every feature image, wears glasses, and has strong opinions about noisy analytic rules. Security can get very dry very quickly, and Profo's job is to stop that happening.

Where to start

• New to Sentinel: How to Create Microsoft Sentinel
• Writing detections: Detection Engineering and Why It's a Must Have
• Learning KQL: The KQL Playbook (Play #1)

The homepage has three full reading paths in its Start here section if you want the longer route.

Stay in touch

• Newsletter: every new post by email, free. Subscribe
• LinkedIn: where I post about new articles. Connect with me
• Support the site: the Supporter tier keeps the lights on and gets you comments and direct email replies. Support IT Professor

Everything here is my own opinion, not my employer's.

Class dismissed.