KQL
Conditional Access, Part One: Design the Estate Before You Write Another Policy
All right class.
Open your tenant. Go to Entra ID, then Conditional Access, then Policies. Count them. If the number sits somewhere between twelve and forty, and if
Author
Bartosz Wysocki
Head of security engineering at a UK MSSP. I started as a SOC analyst and never stopped writing KQL. These days I build the detections, automation and reporting behind a managed SOC on Sentinel and Defender. Profo does the drawings.
121 posts
KQL
Conditional Access, Part One: Design the Estate Before You Write Another Policy
All right class.
Open your tenant. Go to Entra ID, then Conditional Access, then Policies. Count them. If the number sits somewhere between twelve and forty, and if
KQL
Fixing the "Multiple Password Reset by User" Analytic Rule
Alright class.
Another rule from the content hub today: "Multiple Password Reset by user". It gathers password change and reset events from five data sources, Windows
KQL
Fixing the "Attempts to Sign In to Disabled Accounts" Analytic Rule
Alright class.
Seventh lesson in this series.
Back to the cloud for this one. It runs on the Entra sign-in logs, and it fires on error code
KQL
Operation Silent Ledger: A SOC Tabletop Exercise for Adversary in the Middle Phishing
Alright class.
Every tabletop exercise I have sat in ended with everybody agreeing on the right answer. That is the problem with them. There is no clock in
Analytic Rules
Fixing the "RDP Nesting" Analytic Rule
Alright class.
Sixth lesson in this series. In the last one, fixing "Rare RDP Connections", I said nesting was a separate problem and deserved its own
Microsoft Sentinel
Fixing the "Rare RDP Connections" Analytic Rule
Ghost Post Settings
Alright class.
Fifth lesson in this series. We have fixed "MFA Rejected by User", "Privileged Role Assigned Outside PIM", "New
Microsoft Sentinel
Fixing the "Attempt to Bypass Conditional Access Rule" Analytic Rule
Alright class.
Fourth lesson in this series. We have fixed "MFA Rejected by User", "Privileged Role Assigned Outside PIM", and "New User Assigned
Detection Engineering
Fixing the "New User Assigned to Privileged Role" Analytic Rule
Alright class.
Third lesson in this series. We have already fixed "MFA Rejected by User" and "Privileged Role Assigned Outside PIM". Today we are
Microsoft Sentinel
Every Microsoft Sentinel Content Hub Rule for Business Premium: What to Enable, Auto-Close, and Skip
All right class.
If you have not read the original post yet, start there. This one assumes you already have Sentinel running with Entra ID, Defender alerts, Azure
KQL
Finding password.txt Before Someone Else Does
Alright class.
Somewhere in your tenant right now there is a file called password.txt. Probably a few of them. There is a spreadsheet called Logins.xlsx sitting
KQL
Fixing the "Mass Secret Retrieval from Azure Key Vault" Analytic Rule
Alright class.
This time let's take a trip outside Entra into the data plane of an Azure resource. The rule is "Mass secret retrieval from
Microsoft Sentinel
Fixing the "MFA Rejected by User" Analytic Rule
Alright class.
The original "MFA Rejected by User" rule has one fatal flaw baked into its design. It uses a hard UEBA score cutoff as the
Get the next post by email
One email per post, plus the KQL Vault. That's the whole deal.