Analytic Rules

Fixing the "MFA Rejected by User" Analytic Rule

Alright class. The original "MFA Rejected by User"

Fixing the "Rare Application Consent" Analytic Rule

Alright class. Back in the Entra audit log for this

Fixing the "Privileged Role Assigned Outside PIM" Analytic Rule

Alright class. There is a good chance you are using

Fixing the "Account Created From Non-Approved Sources" Analytic Rule

Alright class. A companion piece to the last lesson, from

Fixing the "Account Created or Deleted by Non-Approved User" Analytic Rule

Alright class. This one comes from the Entra ID audit

Fixing the "Account Created and Deleted in Short Timeframe" Analytic Rule

Alright class. Today it is "Account Created and Deleted

PIM Auditing in Microsoft Sentinel: High Value Detections

Alright class. Most lessons in this series are usually autopsies.

Why KQL Enrichment Actually Works (And Why Your Alerts Are So Much Better With It)

All right class. You run an analytic rule. It fires

Beauty of Data Visualization in Microsoft Sentinel Using KQL

Welcome back, class. Tables are useless at scale. You know

Fixing Microsoft's Azure Brute Force Detection: Why Their Template Fires Constantly (And What You Should Change)

All right class. Microsoft ships an out-of-the-box