KQL
Fixing the "Rare Application Consent" Analytic Rule
Alright class.
Back in the Entra audit log for this one. The rule is called "Rare application consent" and the premise comes straight from consent phishing:
Author
Bartosz Wysocki
Head of security engineering at a UK MSSP. I started as a SOC analyst and never stopped writing KQL. These days I build the detections, automation and reporting behind a managed SOC on Sentinel and Defender. Profo does the drawings.
121 posts
KQL
Fixing the "Rare Application Consent" Analytic Rule
Alright class.
Back in the Entra audit log for this one. The rule is called "Rare application consent" and the premise comes straight from consent phishing:
Microsoft Sentinel
Fixing the "Privileged Role Assigned Outside PIM" Analytic Rule
Alright class.
There is a good chance you are using the original "Privileged Role Assigned Outside PIM" rule in the Microsoft Sentinel content hub that has
Microsoft Sentinel
Fixing the "Account Created From Non-Approved Sources" Analytic Rule
Alright class.
A companion piece to the last lesson, from the same Microsoft security-operations page. This one is "Account created from non-approved sources": it
Microsoft Sentinel
Azure Diagnostic Settings: The Azure Policy Rabbit Hole Nobody Told You About
All right class.
If you run Microsoft Sentinel and you are not using Azure Policy to enforce diagnostic settings across your subscriptions, you are doing something wrong.
Diagnostic
Microsoft Sentinel
Fixing the "Account Created or Deleted by Non-Approved User" Analytic Rule
Alright class.
This one comes from the Entra ID audit log, and it is the strangest thing Microsoft ships in the content hub. It is called "Account
Microsoft Defender for Cloud Apps
Defender for Cloud Apps Settings You've Never Touched (But Should)
All right class.
You have Defender for Cloud Apps in your E5 licence. You logged into it once, looked at the Cloud Discovery dashboard, felt impressed with yourself,
Microsoft Sentinel
Fixing the "Account Created and Deleted in Short Timeframe" Analytic Rule
Alright class.
Today it is "Account Created and Deleted in Short Timeframe". The rule pairs a "Delete user" event with an earlier "Add
Defender XDR
You're Paying for Defender XDR Features You Never Enabled
All right class.
You got yourself a good little E5 license. Defender is onboarded. You've got incidents firing, KQL running, analysts investigating. Job done, right?
Go
Detection Engineering
Is Your SOC Actually Doing Anything? Here Is How to Find Out
All right class.
A friend of mine recently took over a security engineering position. The company had a managed SOC on a five year contract, three years into
Microsoft Sentinel
PIM Auditing in Microsoft Sentinel: High Value Detections
Alright class.
Most lessons in this series are usually autopsies. We take a content hub rule, find the line that breaks it, and put it back together properly.
Sentinel Workbook
Why Abandoned Resources Are a Security Problem, Not Just a Billing One
Everything here is built on the work of Dolev Shor. His Azure Orphaned Resources workbook has 745 GitHub stars and is genuinely one of the most useful things
Automation
Sentinel Incident Email Alerts: Free Logic App with ARM Template
All right class
One of the most common questions I've been asked in relation to any type of automation is to create a way for managers
Get the next post by email
One email per post, plus the KQL Vault. That's the whole deal.