KQL
Would You Know If Someone Cancelled Your Azure Subscription?
Alright class.
Yet another lesson in this series, and this one breaks the format. There is no Microsoft rule to fix today, because Microsoft does not ship one.
Author
Bartosz Wysocki
Head of security engineering at a UK MSSP. I started as a SOC analyst and never stopped writing KQL. These days I build the detections, automation and reporting behind a managed SOC on Sentinel and Defender. Profo does the drawings.
121 posts
KQL
Would You Know If Someone Cancelled Your Azure Subscription?
Alright class.
Yet another lesson in this series, and this one breaks the format. There is no Microsoft rule to fix today, because Microsoft does not ship one.
Microsoft Sentinel
Fixing the "Application URL" Analytic Rules, All Three of Them
Alright class.
Another lesson, first one fixing three rules at once. The content hub ships "Changes to Application Logout URL", "Application Redirect URL Update"
KQL
Fixing the "Guest Users Invited to Tenant by New Inviters" Analytic Rule
Alright class.
Today we are looking at "Guest Users Invited to Tenant by New Inviters", a content hub rule that promises to spot guest account abuse
KQL
Sentinel Table Transformations: Cut the Table, Keep the Detections
All right class
Two lessons ago we found the spike.
Here you learned how to walk the Usage table backwards until your data confesses.
Sentinel Log Spikes: Find
Microsoft Sentinel
Anyone With the Link
All right class.
Somebody shared a file this week by picking the option at the top of the list. The one that says Anyone with the link. It
KQL
The Guests Who Never Left
All right class.
Every tenant has them. A guest invited in 2019 for a migration project that finished in 2020, invited by somebody who left in 2022, still
KQL
The Antivirus Setting Your Admins Turned Off Years Ago
All right class.
Somewhere in your estate there is a device with C:\ in its Defender exclusion list. Somebody put it there in 2021 to stop a line
KQL
Fixing the "Excessive Windows Logon Failures" Analytic Rule
Alright class.
A close cousin to one of the previous lessons - that rule counted failures in a 10 minute burst. This one takes a whole day and tries
Microsoft Sentinel
The Sentinel Data Lake Got Respecced: What Actually Moved to Fabric
All right class.
You moved your firewall logs to the data lake tier because the analytics bill had turned into a monthly argument with finance. You built a
Microsoft Sentinel
Fixing the "Failed Logon Attempts by Valid Accounts within 10 mins" Analytic Rule
Alright class.
On-premises this time, back in the Windows security log. The rule watches event 4625, a failed logon, and fires when a valid account fails 20
Microsoft Sentinel
Fixing the "Microsoft Entra ID PowerShell accessing non-Entra ID resources" Analytic Rule
Alright class.
Today's rule is "Microsoft Entra ID PowerShell accessing non-Entra ID resources", which alerts when the old Azure AD PowerShell client obtains
Defender XDR
ISOC Is a Licence Change in an Agentic Costume (And That's Actually Good News)
All right class.
You've got E5. You've got Defender filling the incident queue before your first coffee. You haven't got Sentinel, because
Get the next post by email
One email per post, plus the KQL Vault. That's the whole deal.