Microsoft Sentinel
Continuous Export to Log Analytics: Getting Defender for Cloud Data Where You Need It
Alright, class.
You've got Defender for Cloud on. Alerts keep firing. Recommendations keep stacking. Your Secure Score bounces around daily. The problem is all of it
Topic
Threat Hunting
Threat hunting in Microsoft Sentinel and Defender XDR: building hypotheses, hunting queries you can run today, and KQL for what your rules miss.
20 posts
Microsoft Sentinel
Continuous Export to Log Analytics: Getting Defender for Cloud Data Where You Need It
Alright, class.
You've got Defender for Cloud on. Alerts keep firing. Recommendations keep stacking. Your Secure Score bounces around daily. The problem is all of it
KQL
The KQL User Audit Playbook: Your Template for Investigations
Alright, class. Take your seats.
It’s 3 PM on a Tuesday. An urgent message lands in your inbox from HR, Legal, or maybe even the CISO. The
Microsoft Sentinel
The KQL Playbook (Play #4): The Correlation Play - Joining Tables and Enriching Data
Alright, class. Take your seats.
In our last play, we made you into data janitors of the highest order. You took on the messy, chaotic world of raw
Microsoft Sentinel
The KQL Playbook (Play #3): Mastering Strings, Timestamps, and Ugly JSON
Alright, class. Welcome back to the KQL Playbook.
In our last session, we turned your where clause into a set of surgical tools. You learned the critical difference
Microsoft Sentinel
Hunting Ransomware in Storage Accounts (When You Can't Afford Defender)
Alright, class.
Let's talk about the crown jewels of your Azure kingdom: your Storage Accounts. It's where you keep your critical application data, your
Microsoft Sentinel
Microsoft Threat Intelligence: Giving Your Sentinel a Brain
Alright, class.
Let's talk about the first question every SOC analyst asks when a new alert fires. You see an incident for a strange sign-in
Microsoft Sentinel
Sentinel's Endgame Gear: Sentinel Data Lake
Alright, class.
You’ve tamed your monthly Azure bill. You're filtering logs, using Basic tiers, and your CFO has stopped giving you the evil eye in
KQL
The KQL Playbook (Play #1): A Beginner's Guide to Talking to Your Data
Alright, class. You've done it. You've deployed Sentinel, you've connected your data, and you've even investigated your first incident. You
Get the next post by email
One email per post, plus the KQL Vault. That's the whole deal.