Browsing Category
Microsoft Sentinel
20 posts
Microsoft Sentinel acts as the central SIEM and SOAR platform in many environments. This category focuses on detection engineering, KQL, threat hunting, and SOC workflows.
Articles cover log ingestion, detection design, hunting strategies, and architectural decisions. The focus is on operational SIEM usage, not just setup.
This category is intended for SOC engineers, detection engineers, and security architects working with Sentinel.
Microsoft ISOC explained: what it is, who it is for, and how it compares to Sentinel
On September 23, Microsoft announced the Integrated Security Operations Center, or ISOC, in Microsoft Defender. My LinkedIn feed…
AI playbook generator in Microsoft Sentinel: turn a sentence into working SOC automation
Every SOC lead has the same automation backlog problem. There is a long list of response actions everyone…
BYOVD is back: how EDR killers ship inside RaaS kits and how to stop them
If you have been reading ransomware incident reports over the past few months, you have probably noticed the…
MDTI convergence: threat intelligence now built into Defender and Sentinel
The final phase of the Microsoft Defender Threat Intelligence (MDTI) convergence went generally available in the Defender portal…
AI agent runtime protection in Microsoft Defender for Endpoint
Discovery tells you an agent exists. It doesn’t tell you when someone tries to hijack it. That’s the…
Microsoft Defender for Endpoint custom data collection: get the telemetry you need
If you’ve been working with Microsoft Defender for Endpoint (MDE) for any length of time, you’ve probably run…
Identity attack graph in Microsoft Sentinel: easy find lateral movement paths
Sentinel graph ships with two layers. One is custom graphs, where you build your own schema from any…
Getting started with OpenCTI: threat intelligence connected to Microsoft Sentinel
For the past few years, MISP has been my go-to for threat intelligence. It’s open source, flexible, and…
Defender XDR advanced hunting tables: ingest directly into Sentinel data lake
If you’ve read my Microsoft Sentinel data lake implementation guide, you know I covered a DCR-based workaround for…
UEBA behaviors layer in Microsoft Sentinel: from raw logs to behavioral intelligence
Every SOC analyst knows the feeling. An alert fires. You open the incident. And then the real work…