Microsoft Sentinel
PIM Auditing in Microsoft Sentinel: High Value Detections
Alright class.
Most lessons in this series are usually autopsies. We take a content hub rule, find the line that breaks it, and put it back together properly.
Topic
Microsoft Sentinel
Practical Microsoft Sentinel guides from someone running it in production: deployment, connectors, analytic rules, cost control and investigations.
97 posts
Microsoft Sentinel
PIM Auditing in Microsoft Sentinel: High Value Detections
Alright class.
Most lessons in this series are usually autopsies. We take a content hub rule, find the line that breaks it, and put it back together properly.
Automation
Sentinel Incident Email Alerts: Free Logic App with ARM Template
All right class
One of the most common questions I've been asked in relation to any type of automation is to create a way for managers
Microsoft Sentinel
The Nag Machine: A Logic App That Badgers Your Team About Unowned Sentinel Incidents
All right class
Today is a quick one so you can enjoy deploying it without reading a whole lot about this.
The idea is simple - you are getting
Threat Hunting
Building Your First Threat Hunting Hypothesis (The MITRE Way)
All right class.
Lots of SOC teams say they do threat hunting. What they actually do is run a couple of saved KQL queries on a Friday afternoon
Microsoft Sentinel
Diagnostic Settings Manager Workbook
All right class
This one is free to grab. No strings attached.
Getting resources into Sentinel is one of those tasks that sounds simple until you're
Microsoft Sentinel
Azure Key Vault: The High-Value Queries Your SOC Isn't Running
All right class.
Key Vault is where your secrets live. Connection strings, API keys, certificates, encryption keys, service account credentials. If an attacker gets into your environment and
KQL
Hunting PowerShell Abuse in MDE: Eight Queries, Real Results
All right class
PowerShell is in every serious Windows intrusion. Not because attackers are creative, but because it works, it's already there, and it leaves just
Microsoft Sentinel
Your Sentinel Detection Setup Is Probably Broken. Here's How to Know.
All right class
Most environments running Sentinel today have the same problem. The toggle is on. Rules are firing. UEBA is enabled. And nobody trusts any of it.
SOC
Evaluating and Onboarding a Microsoft MSSP (Without the Chaos)
All right class
If you read lesson one, you already know how to define your scope, lock down your log retention, and write an RFP that forces vendors
Microsoft Sentinel
Choosing a Microsoft MSSP Without Getting Burned (SOC/SIEM)
All right class.
Too many companies hand their entire security operation to the first provider who can say "Sentinel" without choking. Six months later, the invoices
KQL
Conditional Access Health Check: What Your Policies Actually Do
All right class.
This is highly technical post referencing KQL logic and my own (which is even worse than KQL), feel free to skip to the end for
Detection Engineering
Detection Engineering and Why It's a Must Have Part 2
All right class
This is a continuation of part 1 that you can find here.
Detection Engineering: Why Your SIEM Won’t Save YouDetection engineering bridges the gap
Get the next post by email
One email per post, plus the KQL Vault. That's the whole deal.