KQL
Fixing the "Attempts to Sign In to Disabled Accounts" Analytic Rule
Alright class.
Seventh lesson in this series.
Back to the cloud for this one. It runs on the Entra sign-in logs, and it fires on error code
Topic
Analytic Rules
Microsoft Sentinel analytic rules taken apart and rebuilt: why the templates misfire in production, how to tune them, and KQL rules you can deploy.
33 posts
KQL
Fixing the "Attempts to Sign In to Disabled Accounts" Analytic Rule
Alright class.
Seventh lesson in this series.
Back to the cloud for this one. It runs on the Entra sign-in logs, and it fires on error code
Analytic Rules
Fixing the "RDP Nesting" Analytic Rule
Alright class.
Sixth lesson in this series. In the last one, fixing "Rare RDP Connections", I said nesting was a separate problem and deserved its own
Microsoft Sentinel
Fixing the "Rare RDP Connections" Analytic Rule
Ghost Post Settings
Alright class.
Fifth lesson in this series. We have fixed "MFA Rejected by User", "Privileged Role Assigned Outside PIM", "New
Microsoft Sentinel
Fixing the "Attempt to Bypass Conditional Access Rule" Analytic Rule
Alright class.
Fourth lesson in this series. We have fixed "MFA Rejected by User", "Privileged Role Assigned Outside PIM", and "New User Assigned
Detection Engineering
Fixing the "New User Assigned to Privileged Role" Analytic Rule
Alright class.
Third lesson in this series. We have already fixed "MFA Rejected by User" and "Privileged Role Assigned Outside PIM". Today we are
Microsoft Sentinel
Every Microsoft Sentinel Content Hub Rule for Business Premium: What to Enable, Auto-Close, and Skip
All right class.
If you have not read the original post yet, start there. This one assumes you already have Sentinel running with Entra ID, Defender alerts, Azure
KQL
Fixing the "Mass Secret Retrieval from Azure Key Vault" Analytic Rule
Alright class.
This time let's take a trip outside Entra into the data plane of an Azure resource. The rule is "Mass secret retrieval from
Microsoft Sentinel
Fixing the "MFA Rejected by User" Analytic Rule
Alright class.
The original "MFA Rejected by User" rule has one fatal flaw baked into its design. It uses a hard UEBA score cutoff as the
KQL
Fixing the "Rare Application Consent" Analytic Rule
Alright class.
Back in the Entra audit log for this one. The rule is called "Rare application consent" and the premise comes straight from consent phishing:
Microsoft Sentinel
Fixing the "Privileged Role Assigned Outside PIM" Analytic Rule
Alright class.
There is a good chance you are using the original "Privileged Role Assigned Outside PIM" rule in the Microsoft Sentinel content hub that has
Microsoft Sentinel
Fixing the "Account Created From Non-Approved Sources" Analytic Rule
Alright class.
A companion piece to the last lesson, from the same Microsoft security-operations page. This one is "Account created from non-approved sources": it
Microsoft Sentinel
Fixing the "Account Created or Deleted by Non-Approved User" Analytic Rule
Alright class.
This one comes from the Entra ID audit log, and it is the strangest thing Microsoft ships in the content hub. It is called "Account
Get the next post by email
One email per post, plus the KQL Vault. That's the whole deal.