Microsoft Sentinel

The Defender Indicators Page Nobody Opens (But Every SOC Should)

All right class. There is a page in the Defender

Conditional Access, Part Six: Turning Twenty-Five Queries Into an Operating Model

All right class. Five posts, twenty-five queries. If you

Fixing the "Rare Subscription-level Operations in Azure" Analytic Rule

Alright class. Back on the Azure control plane, and a

The Sentinel Data Connector Tier List: What Earns a Slot in Your Loadout

All right class. The Content Hub is a shop with

Fixing the "Multiple Password Reset by User" Analytic Rule

Alright class. Another rule from the content hub today: "

Fixing the "Attempts to Sign In to Disabled Accounts" Analytic Rule

Alright class. Seventh lesson in this series. Back to the

Operation Silent Ledger: A SOC Tabletop Exercise for Adversary in the Middle Phishing

Alright class. Every tabletop exercise I have sat in ended

Fixing the "RDP Nesting" Analytic Rule

Alright class. Sixth lesson in this series. In the last

Fixing the "Rare RDP Connections" Analytic Rule

Ghost Post Settings Alright class. Fifth lesson in this series.

Fixing the "Attempt to Bypass Conditional Access Rule" Analytic Rule

Alright class. Fourth lesson in this series. We have fixed