sentinel.blog

Microsoft Sentinel Data Lake: Revolutionising Security Analytics with Cost-Effective Long-Term Storage

Microsoft has unveiled an exciting development in cloud security: the Microsoft Sentinel Data Lake, currently in preview. This innovative solution promises to transform how organisations handle high-volume security data whilst significantly reducing operational costs. By decoupling storage from compute, Sentinel Data Lake offers unprecedented flexibility and economic efficiency for security

KQL

Microsoft Sentinel Analytical Rule Tuning

Microsoft Sentinel's analytical rules form the backbone of your security operations centre's detection capabilities. However, deploying rules isn't enough. Effective rule tuning is essential for maintaining high detection accuracy whilst minimising alert fatigue. This comprehensive guide explores the critical aspects of Sentinel rule tuning

Automation

SentinelCodeGuard: A Journey from Concept to VS Code Plugin

When I first released SentinelCodeGuard v0.0.1 last month, it was a simple validation tool with a handful of basic features. Today, we are on v0.0.9 – a complete transformation that has evolved into a comprehensive development toolkit for Microsoft Sentinel Analytics Rules. Let me take you through

Automation

SentinelCodeGuard: Revolutionising Microsoft Sentinel Rule Development

A VS Code extension that transforms how security professionals create, validate, and manage Microsoft Sentinel analytics rules

A New Chapter: Sentinel.blog Has Found Its Permanent Home

After a couple of hosting transitions within my FTE Azure tenant, I'm delighted to announce that sentinel.blog has finally migrated to its permanent home. This marks a significant shift from corporate hosting to a private solution that I have complete control over. Privacy Matters: Why German Hosting

Members Featured

Migration Madness

Automation Featured

Simplifying Azure Log Analytics Table Retention Management: A Modern Approach

The Challenge: Retention Management at Scale If you've ever managed Azure Log Analytics workspaces at enterprise scale, you'll know the pain of manually configuring retention policies across dozens—or even hundreds—of tables. The Azure portal, whilst functional, becomes cumbersome when you need to update retention

KQL Featured

Leveraging Summary Rules in Microsoft Sentinel: A Practical Guide

Introduction In today's security landscape, organisations face an overwhelming volume of security data. Microsoft Sentinel, as a cloud-native SIEM solution, processes vast amounts of logs daily. However, the sheer volume can impact both performance and cost-efficiency. This is where Summary Rules come into play—a powerful feature that

News

🚧 Infrastructure Upgrade Successfully Completed 🚧

The planned infrastructure upgrade has been completed All services have been restored and are now operating with improved performance and enhanced security. The migration included several significant improvements: * Upgraded to a more scalable and resilient database tier * Moved workloads to a more efficient containerised environment * Enhanced data durability with optimised

News

🚧 Scheduled Outage: Platform Migration from 17–19 May 🚧

I am implementing significant infrastructure upgrades to enhance performance and reliability for our growing community. Due to the unexpected pace of membership growth, I've determined that stricter security controls and expanded capacity are now essential. To facilitate these improvements, there will be a planned service outage starting Friday,

Automation

Part 1 - Modularising Logic Apps: Building Reusable Cloud Automation Solutions

Introduction Did you know you can call Logic Apps from other Logic Apps? This powerful capability truly transforms how you build cloud automation solutions! In the evolving landscape of cloud automation, Microsoft's Logic Apps stand out as a powerful solution for creating integrated workflows with minimal code. As

Identity

Part 6 - Beyond Passwords: Strengthening Security with Zero Trust and Phishing-Resistant Authentication

Introduction This is the final instalment of our six-part series on phishing attacks and defences. Part 1 provided an overview of the series, Part 2 explored various phishing attack types, Part 3 examined advanced phishing frameworks, our bonus content delved into post-exploitation techniques, Part 4 covered comprehensive protection strategies, and

MicrosoftSecurity

Part 5 - Advanced Phishing Detection and Response with Microsoft Sentinel and the Unified SOC

This is Part 5 of our six-part series on phishing attacks and defences. Part 1 provided an overview of the series, Part 2 explored various phishing attack types, Part 3 examined advanced phishing frameworks, our bonus content delved into post-exploitation techniques, and Part 4 covered comprehensive protection strategies. Despite our

SupportersTier

Blog Update: Reflecting on Our First 30 Days

Automation

Breach Defence Automation: Creating Your Hybrid Account Kill Switch with Microsoft Sentinel and Logic Apps

In cybersecurity, response time is everything. When a suspicious user account is detected, every second counts. Today, I'm sharing a comprehensive security automation tool I've built using Logic Apps to respond to Microsoft Sentinel incidents by automatically disabling compromised accounts across both Entra ID and on-premises

MicrosoftSecurity

Part 4 - Building Resilient Defences with Microsoft Security: A Multi-layered Approach

Introduction This is Part 4 of our six-part series on phishing attacks and defences. In previous instalments, we've explored various phishing attack types, examined advanced phishing frameworks, and delved into post-exploitation techniques. As phishing attacks have grown increasingly sophisticated, with tools capable of bypassing traditional security controls, building

Automation

Building an Automated Sentinel Incident Reporting System with Azure Logic Apps

Sentinel Alerts to Actionable Insights: Streamlining Security Incident Communication with Power-Packed Logic Apps

Automation Featured

Bonus - The Growing Threat of Token Theft: How Attackers Exploit Stolen Authentication After Successful Phishing

Introduction This is special bonus content in our six-part series on phishing attacks and defences. Part 1 provided an overview of the series, Part 2 explored various phishing attack types, and Part 3 examined the advanced phishing framework Evilginx. Successfully obtaining credentials through phishing is rarely the ultimate goal for

Conference

Part 3 - Inside the Attacker's Toolkit: Advanced Phishing Frameworks and Infrastructure

Introduction This is Part 3 of our six-part series on phishing attacks and defences. Part 1 provided an overview of the series, while Part 2 explored the various types of phishing attacks organisations face today. As security awareness has improved and organisations have deployed increasingly sophisticated defences, including multi-factor authentication

Conference

Part 2 - The Phishing Threat Landscape: Understanding Attack Types and Techniques

Beyond the Bait: Navigating the Evolving Maze of Modern Phishing Tactics

Automation

Automating Security: Creating Microsoft Sentinel Watchlists from Entra ID Group Membership

Automating Sentinel Watchlists with Entra ID Groups and Logic Apps

Phishing

Part 1 - Combating Modern Phishing Attacks: Introduction to a Six-Part Security Journey

From Hook to Defence: Mastering the Phishing Battlefield in the Modern Threat Landscape.

AzureFunction

Streamlining Security Event Collection with Microsoft 365 Defender and Azure Functions

In today's complex cybersecurity landscape, organisations need efficient ways to collect, process, and analyse security events from their Microsoft environments. Microsoft 365 Defender (MDE) offers powerful threat detection capabilities, but extracting and integrating this valuable security data with other systems can be challenging. In this post, I'

SecDevOps

Simplifying Microsoft Logic App Exports: A Powerful Tool for DevOps Teams

Export Logic Apps with Ease: One Script to Rule All Environments!

Automation

Automate Microsoft Sentinel Updates: A Complete PowerShell Toolkit

Security at Scale: Sentinel Updates Without the Hassle!