KQL
Conditional Access Health Check: What Your Policies Actually Do
All right class.
This is highly technical post referencing KQL logic and my own (which is even worse than KQL), feel free to skip to the end for
Author
Bartosz Wysocki
Head of security engineering at a UK MSSP. I started as a SOC analyst and never stopped writing KQL. These days I build the detections, automation and reporting behind a managed SOC on Sentinel and Defender. Profo does the drawings.
121 posts
KQL
Conditional Access Health Check: What Your Policies Actually Do
All right class.
This is highly technical post referencing KQL logic and my own (which is even worse than KQL), feel free to skip to the end for
Detection Engineering
Detection Engineering and Why It's a Must Have Part 2
All right class
This is a continuation of part 1 that you can find here.
Detection Engineering: Why Your SIEM Won’t Save YouDetection engineering bridges the gap
Microsoft Sentinel
Detection Engineering and Why It's a Must Have
Why Your SIEM Won't Save You Without It
All right class
I've seen people think that you can just turn on Microsoft Sentinel, wiring
Logic Apps
One‑Click Threat Intel: Add IOCs from Sentinel Incidents with a Logic App
All right class.
You’re in an incident. You pivot on an IP. You know it’s bad.
You want it in Threat Intelligence so the next time
Microsoft Sentinel
Sentinel Cost Spike: How To Actually Find The Culprit Table
All right class.
Your CFO walks over and asks why the Azure bill just went up and why “Microsoft Sentinel” is suddenly the top line item.
You open
Defender XDR
Defender for Identity: What's The Point? (And Is It Actually Worth Your Time)
All right class.
You have Active Directory. You have domain controllers. You're probably already paying for M365 or E5. Microsoft ships Defender for Identity and tells
Microsoft Sentinel
Microsoft Sentinel on a Shoestring: What You Can Actually Do with Business Premium
All right class
You have Entra ID P1 and Business Premium. You need a SIEM. This is what you can actually build, what it costs, and how to
Microsoft Sentinel
Why KQL Enrichment Actually Works (And Why Your Alerts Are So Much Better With It)
All right class.
You run an analytic rule. It fires (duh). Your SOC analyst opens the incident. They see a CallerIpAddress, a Caller name, and OperationNameValue. Then what?
Microsoft Sentinel
Data Connectors: The Order That Actually Matters
All right class
I've seen people enable data connectors wrong. They grab whatever sounds useful, flip the switch, and hope detection happens. You need a sequence.
Microsoft Sentinel
Sentinel Deployment Checklist: What You Actually Need Before Day One
All right class.
This is the pre-deployment checklist for people who actually want to know what they're doing. The architectural decisions that determine whether you
Microsoft Sentinel
User Audit Investigation Workbook: Deploy in Minutes, Investigate in Seconds
All right class.
This is the workbook I wish people would build once, instead of recreating the same “user activity timeline” from scratch every time HR/Legal comes
SOC
KQL User Audit Playbook V2: The Insider Threat Investigation Guide
All right class.
This is a continuation of my previous lesson, which contains useful queries for insider risk hunting. Make sure to read it first, as it may
Get the next post by email
One email per post, plus the KQL Vault. That's the whole deal.