Analytic Rules

Every Microsoft Sentinel Content Hub Rule for Business Premium: What to Enable, Auto-Close, and Skip

All right class. If you have not read the original

Fixing the "Mass Secret Retrieval from Azure Key Vault" Analytic Rule

Alright class. This time let's take a trip

Fixing the "MFA Rejected by User" Analytic Rule

Alright class. The original "MFA Rejected by User"

Fixing the "Rare Application Consent" Analytic Rule

Alright class. Back in the Entra audit log for this

Fixing the "Privileged Role Assigned Outside PIM" Analytic Rule

Alright class. There is a good chance you are using

Fixing the "Account Created From Non-Approved Sources" Analytic Rule

Alright class. A companion piece to the last lesson, from

Fixing the "Account Created or Deleted by Non-Approved User" Analytic Rule

Alright class. This one comes from the Entra ID audit

Fixing the "Account Created and Deleted in Short Timeframe" Analytic Rule

Alright class. Today it is "Account Created and Deleted

PIM Auditing in Microsoft Sentinel: High Value Detections

Alright class. Most lessons in this series are usually autopsies.

Why KQL Enrichment Actually Works (And Why Your Alerts Are So Much Better With It)

All right class. You run an analytic rule. It fires