KQL

The Antivirus Setting Your Admins Turned Off Years Ago

All right class. Somewhere in your estate there is a

Fixing the "Excessive Windows Logon Failures" Analytic Rule

Alright class. A close cousin to one of the previous

The Sentinel Data Lake Got Respecced: What Actually Moved to Fabric

All right class. You moved your firewall logs to the

Fixing the "Failed Logon Attempts by Valid Accounts within 10 mins" Analytic Rule

Alright class. On-premises this time, back in the Windows

Fixing the "Microsoft Entra ID PowerShell accessing non-Entra ID resources" Analytic Rule

Alright class. Today's rule is "Microsoft Entra

Fixing the "Mass Cloud resource deletions Time Series Anomaly" Analytic Rule

Alright class. Today we are looking at Mass Cloud resource

Fixing the "Suspicious granting of permissions to an account" Analytic Rule

Alright class. Today's patient is "Suspicious granting

Conditional Access, Part Six: Turning Twenty-Five Queries Into an Operating Model

All right class. Five posts, twenty-five queries. If you

Fixing the "Rare Subscription-level Operations in Azure" Analytic Rule

Alright class. Back on the Azure control plane, and a

Conditional Access, Part Five: Cross-Tenant Access, MFA Trust, and the Partner Problem

All right class. Part two left a loose end and