Bartosz Wysocki

Fixing the "Account Created From Non-Approved Sources" Analytic Rule

Alright class. A companion piece to the last lesson, from

Azure Diagnostic Settings: The Azure Policy Rabbit Hole Nobody Told You About

All right class. If you run Microsoft Sentinel and you

Fixing the "Account Created or Deleted by Non-Approved User" Analytic Rule

Alright class. This one comes from the Entra ID audit

Defender for Cloud Apps Settings You've Never Touched (But Should)

All right class. You have Defender for Cloud Apps in

Fixing the "Account Created and Deleted in Short Timeframe" Analytic Rule

Alright class. Today it is "Account Created and Deleted

You're Paying for Defender XDR Features You Never Enabled

All right class. You got yourself a good little E5

Is Your SOC Actually Doing Anything? Here Is How to Find Out

All right class. A friend of mine recently took over

PIM Auditing in Microsoft Sentinel: High Value Detections

Alright class. Most lessons in this series are usually autopsies.

Why Abandoned Resources Are a Security Problem, Not Just a Billing One

Everything here is built on the work of Dolev Shor.

Sentinel Incident Email Alerts: Free Logic App with ARM Template

All right class One of the most common questions I&