SOC
Why You Actually Need Microsoft Defender for Cloud (And What It Actually Does)
Alright, class. Take your seats.
Your infrastructure is in the cloud now. Could be Azure. Might be AWS. Probably both. Maybe GCP too, because apparently someone in your
Topic
SOC
For SOC analysts on the Microsoft stack: triage, investigations, hunting, interviews and the day-to-day work in Sentinel and Defender nobody teaches.
37 posts
SOC
Why You Actually Need Microsoft Defender for Cloud (And What It Actually Does)
Alright, class. Take your seats.
Your infrastructure is in the cloud now. Could be Azure. Might be AWS. Probably both. Maybe GCP too, because apparently someone in your
Microsoft Defender for Cloud Apps
A SOC Analyst's Introduction to Defender for Cloud Apps
Alright, class. Take your seats.
Let's talk about a problem that keeps every security professional up at night. It's not the alerts you see;
KQL
The KQL User Audit Playbook: Your Template for Investigations
Alright, class. Take your seats.
It’s 3 PM on a Tuesday. An urgent message lands in your inbox from HR, Legal, or maybe even the CISO. The
KQL
The KQL Playbook (Play #5): The Anomaly Play - Finding the 'Weird'
Alright, class. Take your seats.
In our last beginner session, you became intelligence analysts. You learned to master let and join, weaving together disparate log sources to build
Microsoft Sentinel
The KQL Playbook (Play #4): The Correlation Play - Joining Tables and Enriching Data
Alright, class. Take your seats.
In our last play, we made you into data janitors of the highest order. You took on the messy, chaotic world of raw
Microsoft Sentinel
The KQL Playbook (Play #3): Mastering Strings, Timestamps, and Ugly JSON
Alright, class. Welcome back to the KQL Playbook.
In our last session, we turned your where clause into a set of surgical tools. You learned the critical difference
Microsoft Sentinel
The KQL Playbook (Play #2): Mastering the Matching Game
Alright, class. Welcome back to the KQL playbook.
In our last session, we covered the four core moves of KQL. You learned how to grab a table, filter
Microsoft Sentinel
Sentinel's Built-in Consultant: An In-Depth Guide to SOC Optimization
Alright, class.
You've built your security operations center in Sentinel. The logs are flowing, the alerts are firing, and your team is bravely fighting the good
Microsoft Sentinel
Microsoft Threat Intelligence: Giving Your Sentinel a Brain
Alright, class.
Let's talk about the first question every SOC analyst asks when a new alert fires. You see an incident for a strange sign-in
Career Advice
MSSP SOC Analyst Interviews (Microsoft Stack): The questions you’ll actually get -and the answers I’d actually give
Alright class, let's do this.
Grab your coffee, silence your notifications, and get ready. We're about to break down the real interview questions you&
Microsoft Sentinel
Microsoft Sentinel: How to Nuke a Noisy Incident Queue
Alright, class.
We've all had that moment. You log in on a Monday morning, a fresh coffee in hand, feeling a dangerous glimmer of hope for
Security Operations
A Day in the Life of a SOC Analyst
Ever wonder what a Security Operations Centre (SOC) Analyst actually does all day? Forget the Hollywood stereotypes of someone in a dark hoodie typing furiously to "hack
Get the next post by email
One email per post, plus the KQL Vault. That's the whole deal.