Microsoft Sentinel
Detection Engineering and Why It's a Must Have
Why Your SIEM Won't Save You Without It
All right class
I've seen people think that you can just turn on Microsoft Sentinel, wiring
Topic
Microsoft Sentinel
Practical Microsoft Sentinel guides from someone running it in production: deployment, connectors, analytic rules, cost control and investigations.
97 posts
Microsoft Sentinel
Detection Engineering and Why It's a Must Have
Why Your SIEM Won't Save You Without It
All right class
I've seen people think that you can just turn on Microsoft Sentinel, wiring
Logic Apps
One‑Click Threat Intel: Add IOCs from Sentinel Incidents with a Logic App
All right class.
You’re in an incident. You pivot on an IP. You know it’s bad.
You want it in Threat Intelligence so the next time
Microsoft Sentinel
Sentinel Cost Spike: How To Actually Find The Culprit Table
All right class.
Your CFO walks over and asks why the Azure bill just went up and why “Microsoft Sentinel” is suddenly the top line item.
You open
Defender XDR
Defender for Identity: What's The Point? (And Is It Actually Worth Your Time)
All right class.
You have Active Directory. You have domain controllers. You're probably already paying for M365 or E5. Microsoft ships Defender for Identity and tells
Microsoft Sentinel
Microsoft Sentinel on a Shoestring: What You Can Actually Do with Business Premium
All right class
You have Entra ID P1 and Business Premium. You need a SIEM. This is what you can actually build, what it costs, and how to
Microsoft Sentinel
Why KQL Enrichment Actually Works (And Why Your Alerts Are So Much Better With It)
All right class.
You run an analytic rule. It fires (duh). Your SOC analyst opens the incident. They see a CallerIpAddress, a Caller name, and OperationNameValue. Then what?
Microsoft Sentinel
Data Connectors: The Order That Actually Matters
All right class
I've seen people enable data connectors wrong. They grab whatever sounds useful, flip the switch, and hope detection happens. You need a sequence.
Microsoft Sentinel
Sentinel Deployment Checklist: What You Actually Need Before Day One
All right class.
This is the pre-deployment checklist for people who actually want to know what they're doing. The architectural decisions that determine whether you
Microsoft Sentinel
User Audit Investigation Workbook: Deploy in Minutes, Investigate in Seconds
All right class.
This is the workbook I wish people would build once, instead of recreating the same “user activity timeline” from scratch every time HR/Legal comes
Microsoft Sentinel
Teams Threat Protection: What Actually Changed and What You Can Actually Hunt
All right class
Your SOC has limited visibility into Teams. Attackers run credential theft campaigns in chat. You see some of it through audit logs if you'
Sentinel Workbook
Three Essential Sentinel Workbooks You Should Deploy Right Now
All right class.
Workbooks That Actually Solve Problems
Microsoft has already built three workbooks in Content Hub that handle the problems you're dealing with right now.
Microsoft Sentinel
Sentinel Workbooks: Deploy and Customise Your First Dashboard
Welcome back class.
You're running Sentinel. Logs are flowing. Alerts are firing. And your team is copy-pasting the same KQL query into Log Analytics fifty
Get the next post by email
One email per post, plus the KQL Vault. That's the whole deal.