Analytic Rules

Conditional Access, Part Six: Turning Twenty-Five Queries Into an Operating Model

All right class. Five posts, twenty-five queries. If you

Fixing the "Rare Subscription-level Operations in Azure" Analytic Rule

Alright class. Back on the Azure control plane, and a

Fixing the "Multiple Password Reset by User" Analytic Rule

Alright class. Another rule from the content hub today: "

Fixing the "Attempts to Sign In to Disabled Accounts" Analytic Rule

Alright class. Seventh lesson in this series. Back to the

Fixing the "RDP Nesting" Analytic Rule

Alright class. Sixth lesson in this series. In the last

Fixing the "Rare RDP Connections" Analytic Rule

Ghost Post Settings Alright class. Fifth lesson in this series.

Fixing the "Attempt to Bypass Conditional Access Rule" Analytic Rule

Alright class. Fourth lesson in this series. We have fixed

Fixing the "New User Assigned to Privileged Role" Analytic Rule

Alright class. Third lesson in this series. We have already

Every Microsoft Sentinel Content Hub Rule for Business Premium: What to Enable, Auto-Close, and Skip

All right class. If you have not read the original

Fixing the "Mass Secret Retrieval from Azure Key Vault" Analytic Rule

Alright class. This time let's take a trip