Microsoft Sentinel
Fixing the "Mass Cloud resource deletions Time Series Anomaly" Analytic Rule
Alright class.
Today we are looking at Mass Cloud resource deletions Time Series Anomaly, a content hub rule that promises to catch an adversary tearing down your Azure
Topic
KQL
KQL you can actually run in Microsoft Sentinel and Defender Advanced Hunting, from beginner basics to detections, hunting queries and investigations.
67 posts
Microsoft Sentinel
Fixing the "Mass Cloud resource deletions Time Series Anomaly" Analytic Rule
Alright class.
Today we are looking at Mass Cloud resource deletions Time Series Anomaly, a content hub rule that promises to catch an adversary tearing down your Azure
KQL
Fixing the "Suspicious granting of permissions to an account" Analytic Rule
Alright class.
Today's patient is "Suspicious granting of permissions to an account", the content hub rule that promises an alert "when a previously
KQL
Conditional Access, Part Six: Turning Twenty-Five Queries Into an Operating Model
All right class.
Five posts, twenty-five queries. If you have been following along, you now have a folder of KQL that describes your Conditional Access estate better
Microsoft Sentinel
Fixing the "Rare Subscription-level Operations in Azure" Analytic Rule
Alright class.
Back on the Azure control plane, and a rule with a good nose for targets. It watches AzureActivity for sensitive subscription operations, and the description picks
KQL
Conditional Access, Part Five: Cross-Tenant Access, MFA Trust, and the Partner Problem
All right class.
Part two left a loose end and I promised to come back for it. Guests cannot register passkeys in your tenant (MC1459133 starts fixing this
Entra ID
Conditional Access, Part Four: Tokens, Sessions, and the Control You Do Not Have
All right class.
Three posts in. We designed the estate, we fixed the credential, and we dealt with the device. Every one of those controls does its work
KQL
Conditional Access, Part Three: Device Controls, and What Compliant Actually Proves
All right class.
Two posts in. We built the estate, and then we fixed the credential. Today we deal with the control that most security teams rate as
Conditional Access
Conditional Access, Part Two: Authentication Strengths and the Road to Phishing-Resistant
All right class.
Conditional Access, Part One: Design the EstatePart one of the series covers how the engine actually decides, the persona model, naming, exclusions, ring deployment, the
KQL
Conditional Access, Part One: Design the Estate Before You Write Another Policy
All right class.
Open your tenant. Go to Entra ID, then Conditional Access, then Policies. Count them. If the number sits somewhere between twelve and forty, and if
KQL
Fixing the "Multiple Password Reset by User" Analytic Rule
Alright class.
Another rule from the content hub today: "Multiple Password Reset by user". It gathers password change and reset events from five data sources, Windows
KQL
Fixing the "Attempts to Sign In to Disabled Accounts" Analytic Rule
Alright class.
Seventh lesson in this series.
Back to the cloud for this one. It runs on the Entra sign-in logs, and it fires on error code
KQL
Operation Silent Ledger: A SOC Tabletop Exercise for Adversary in the Middle Phishing
Alright class.
Every tabletop exercise I have sat in ended with everybody agreeing on the right answer. That is the problem with them. There is no clock in
Get the next post by email
One email per post, plus the KQL Vault. That's the whole deal.