Defender XDR
ISOC Is a Licence Change in an Agentic Costume (And That's Actually Good News)
All right class.
You've got E5. You've got Defender filling the incident queue before your first coffee. You haven't got Sentinel, because
Topic
Automation
Automating Microsoft Sentinel: Logic App playbooks with ARM templates, PowerShell scripts for the bulk jobs, and automation that saves your SOC time.
10 posts
Defender XDR
ISOC Is a Licence Change in an Agentic Costume (And That's Actually Good News)
All right class.
You've got E5. You've got Defender filling the incident queue before your first coffee. You haven't got Sentinel, because
Automation
Sentinel Incident Email Alerts: Free Logic App with ARM Template
All right class
One of the most common questions I've been asked in relation to any type of automation is to create a way for managers
Microsoft Sentinel
The Nag Machine: A Logic App That Badgers Your Team About Unowned Sentinel Incidents
All right class
Today is a quick one so you can enjoy deploying it without reading a whole lot about this.
The idea is simple - you are getting
Logic Apps
One‑Click Threat Intel: Add IOCs from Sentinel Incidents with a Logic App
All right class.
You’re in an incident. You pivot on an IP. You know it’s bad.
You want it in Threat Intelligence so the next time
Automation
The Self-Updating Watchlist: Automating Sentinel with Logic Apps & Graph API
Alright, class.
Let's talk about one of the most powerful tools in your Sentinel armoury: the Watchlist. It's how you teach Sentinel about your
Microsoft Sentinel
Herding Cats with Sentinel: An In-Depth Guide to Workspace Manager
Alright, class.
In a previous lesson, we discussed the "Seven Deadly Sins" of a Sentinel deployment, and Sin #1 was "Workspace Sprawl." I told
Microsoft Sentinel
Microsoft Sentinel Rule Tuning: Kick the Noise, Keep the Signal
Alright, class. Welcome back.
You've come a long way. You've deployed Sentinel, you're shipping logs, you've created analytic rules (maybe
Microsoft Sentinel
Microsoft Sentinel: How to Nuke a Noisy Incident Queue
Alright, class.
We've all had that moment. You log in on a Monday morning, a fresh coffee in hand, feeling a dangerous glimmer of hope for
Microsoft Sentinel
How to Bulk Enable All Sentinel Analytic Rules (The Easy Way)
Alright, class, let's have an honest conversation.
You've just deployed Microsoft Sentinel. You followed the guides. You've connected your data sources from
Microsoft Sentinel
Microsoft Sentinel: Let the Robots Do the Work - Your First Automation Playbook
Alright, class, let's talk about burnout. Specifically, the burnout that comes from the first five minutes of every single incident. A high-severity alert fires. Now
Get the next post by email
One email per post, plus the KQL Vault. That's the whole deal.