SOC
Attack Simulation Training in Microsoft Defender for Office 365
Allright class
Built into your Microsoft 365 E5 or Defender for Office 365 Plan 2 license is a phishing simulation tool that doesn't suck as hard
Author
Bartosz Wysocki
Head of security engineering at a UK MSSP. I started as a SOC analyst and never stopped writing KQL. These days I build the detections, automation and reporting behind a managed SOC on Sentinel and Defender. Profo does the drawings.
121 posts
SOC
Attack Simulation Training in Microsoft Defender for Office 365
Allright class
Built into your Microsoft 365 E5 or Defender for Office 365 Plan 2 license is a phishing simulation tool that doesn't suck as hard
Microsoft Sentinel
Continuous Export to Log Analytics: Getting Defender for Cloud Data Where You Need It
Alright, class.
You've got Defender for Cloud on. Alerts keep firing. Recommendations keep stacking. Your Secure Score bounces around daily. The problem is all of it
Security Operations
Connecting Your Environment to Defender for Cloud: Azure, AWS, GCP, and On-Premises
Alright, class. You've decided to actually use Defender for Cloud. Now comes the fun part: connecting everything.
Your infrastructure is scattered. Azure here. AWS there. Some
SOC
Why You Actually Need Microsoft Defender for Cloud (And What It Actually Does)
Alright, class. Take your seats.
Your infrastructure is in the cloud now. Could be Azure. Might be AWS. Probably both. Maybe GCP too, because apparently someone in your
Microsoft Sentinel
Post-Deployment Sentinel and Defender XDR: You're Not Done Yet
Alright, class.
So you've deployed Sentinel. You've got Defender XDR running. Your SOC is live. Alerts are coming in. Your Secure Score went up.
Microsoft Defender for Cloud Apps
App Governance in Defender for Cloud Apps: Your OAuth App Security Command Centre
Alright, class. Take your seats.
We've covered Shadow IT discovery. We've drilled deep into policies. You've learned how to detect, block, and
Microsoft Defender for Cloud Apps
Mastering Policies in Defender for Cloud Apps: A Deep Dive for the SOC Trenches
Alright, class. Take your seats. Today is a long lesson, but given the subject, it's well worth it. Grab your coffee (and maybe another one down
Microsoft Defender for Cloud Apps
A SOC Analyst's Introduction to Defender for Cloud Apps
Alright, class. Take your seats.
Let's talk about a problem that keeps every security professional up at night. It's not the alerts you see;
KQL
The KQL User Audit Playbook: Your Template for Investigations
Alright, class. Take your seats.
It’s 3 PM on a Tuesday. An urgent message lands in your inbox from HR, Legal, or maybe even the CISO. The
KQL
The KQL Playbook (Play #5): The Anomaly Play - Finding the 'Weird'
Alright, class. Take your seats.
In our last beginner session, you became intelligence analysts. You learned to master let and join, weaving together disparate log sources to build
Microsoft Sentinel
The KQL Playbook (Play #4): The Correlation Play - Joining Tables and Enriching Data
Alright, class. Take your seats.
In our last play, we made you into data janitors of the highest order. You took on the messy, chaotic world of raw
Microsoft Sentinel
The KQL Playbook (Play #3): Mastering Strings, Timestamps, and Ugly JSON
Alright, class. Welcome back to the KQL Playbook.
In our last session, we turned your where clause into a set of surgical tools. You learned the critical difference
Get the next post by email
One email per post, plus the KQL Vault. That's the whole deal.