Microsoft Sentinel
The Sentinel Data Connector Tier List: What Earns a Slot in Your Loadout
All right class.
The Content Hub is a shop with hundreds of items and no gold limit. Every connector is right there, every one of them is free
Topic
Detection Engineering
Detection engineering for Microsoft Sentinel and Defender XDR: building, testing and rebuilding analytic rules so they catch attacks instead of noise.
35 posts
Microsoft Sentinel
The Sentinel Data Connector Tier List: What Earns a Slot in Your Loadout
All right class.
The Content Hub is a shop with hundreds of items and no gold limit. Every connector is right there, every one of them is free
Defender XDR
The Defender Tier List: What to Turn On First When You Own All of It
All right class.
You have E5. Every Defender product in the suite is licensed and sitting there. Somebody enabled Defender for Endpoint on about two thirds of the
KQL
Fixing the "Multiple Password Reset by User" Analytic Rule
Alright class.
Another rule from the content hub today: "Multiple Password Reset by user". It gathers password change and reset events from five data sources, Windows
KQL
Fixing the "Attempts to Sign In to Disabled Accounts" Analytic Rule
Alright class.
Seventh lesson in this series.
Back to the cloud for this one. It runs on the Entra sign-in logs, and it fires on error code
KQL
Operation Silent Ledger: A SOC Tabletop Exercise for Adversary in the Middle Phishing
Alright class.
Every tabletop exercise I have sat in ended with everybody agreeing on the right answer. That is the problem with them. There is no clock in
Analytic Rules
Fixing the "RDP Nesting" Analytic Rule
Alright class.
Sixth lesson in this series. In the last one, fixing "Rare RDP Connections", I said nesting was a separate problem and deserved its own
Microsoft Sentinel
Fixing the "Rare RDP Connections" Analytic Rule
Ghost Post Settings
Alright class.
Fifth lesson in this series. We have fixed "MFA Rejected by User", "Privileged Role Assigned Outside PIM", "New
Microsoft Sentinel
Fixing the "Attempt to Bypass Conditional Access Rule" Analytic Rule
Alright class.
Fourth lesson in this series. We have fixed "MFA Rejected by User", "Privileged Role Assigned Outside PIM", and "New User Assigned
Detection Engineering
Fixing the "New User Assigned to Privileged Role" Analytic Rule
Alright class.
Third lesson in this series. We have already fixed "MFA Rejected by User" and "Privileged Role Assigned Outside PIM". Today we are
KQL
Finding password.txt Before Someone Else Does
Alright class.
Somewhere in your tenant right now there is a file called password.txt. Probably a few of them. There is a spreadsheet called Logins.xlsx sitting
KQL
Fixing the "Mass Secret Retrieval from Azure Key Vault" Analytic Rule
Alright class.
This time let's take a trip outside Entra into the data plane of an Azure resource. The rule is "Mass secret retrieval from
Microsoft Sentinel
Fixing the "MFA Rejected by User" Analytic Rule
Alright class.
The original "MFA Rejected by User" rule has one fatal flaw baked into its design. It uses a hard UEBA score cutoff as the
Get the next post by email
One email per post, plus the KQL Vault. That's the whole deal.