Microsoft Sentinel
Fixing the "Attempt to Bypass Conditional Access Rule" Analytic Rule
Alright class.
Fourth lesson in this series. We have fixed "MFA Rejected by User", "Privileged Role Assigned Outside PIM", and "New User Assigned
Topic
Microsoft Sentinel
Practical Microsoft Sentinel guides from someone running it in production: deployment, connectors, analytic rules, cost control and investigations.
96 posts
Microsoft Sentinel
Fixing the "Attempt to Bypass Conditional Access Rule" Analytic Rule
Alright class.
Fourth lesson in this series. We have fixed "MFA Rejected by User", "Privileged Role Assigned Outside PIM", and "New User Assigned
Microsoft Sentinel
Every Microsoft Sentinel Content Hub Rule for Business Premium: What to Enable, Auto-Close, and Skip
All right class.
If you have not read the original post yet, start there. This one assumes you already have Sentinel running with Entra ID, Defender alerts, Azure
KQL
Finding password.txt Before Someone Else Does
Alright class.
Somewhere in your tenant right now there is a file called password.txt. Probably a few of them. There is a spreadsheet called Logins.xlsx sitting
KQL
Fixing the "Mass Secret Retrieval from Azure Key Vault" Analytic Rule
Alright class.
This time let's take a trip outside Entra into the data plane of an Azure resource. The rule is "Mass secret retrieval from
Microsoft Sentinel
Fixing the "MFA Rejected by User" Analytic Rule
Alright class.
The original "MFA Rejected by User" rule has one fatal flaw baked into its design. It uses a hard UEBA score cutoff as the
KQL
Fixing the "Rare Application Consent" Analytic Rule
Alright class.
Back in the Entra audit log for this one. The rule is called "Rare application consent" and the premise comes straight from consent phishing:
Microsoft Sentinel
Fixing the "Privileged Role Assigned Outside PIM" Analytic Rule
Alright class.
There is a good chance you are using the original "Privileged Role Assigned Outside PIM" rule in the Microsoft Sentinel content hub that has
Microsoft Sentinel
Fixing the "Account Created From Non-Approved Sources" Analytic Rule
Alright class.
A companion piece to the last lesson, from the same Microsoft security-operations page. This one is "Account created from non-approved sources": it
Microsoft Sentinel
Azure Diagnostic Settings: The Azure Policy Rabbit Hole Nobody Told You About
All right class.
If you run Microsoft Sentinel and you are not using Azure Policy to enforce diagnostic settings across your subscriptions, you are doing something wrong.
Diagnostic
Microsoft Sentinel
Fixing the "Account Created or Deleted by Non-Approved User" Analytic Rule
Alright class.
This one comes from the Entra ID audit log, and it is the strangest thing Microsoft ships in the content hub. It is called "Account
Microsoft Sentinel
Fixing the "Account Created and Deleted in Short Timeframe" Analytic Rule
Alright class.
Today it is "Account Created and Deleted in Short Timeframe". The rule pairs a "Delete user" event with an earlier "Add
Microsoft Sentinel
PIM Auditing in Microsoft Sentinel: High Value Detections
Alright class.
Most lessons in this series are usually autopsies. We take a content hub rule, find the line that breaks it, and put it back together properly.
Get the next post by email
One email per post, plus the KQL Vault. That's the whole deal.