sentinel.blog

Sentinel-As-Code 26.07: From Markdown to the Boardroom

Sentinel-As-Code 26.07 renders the Documenter's daily Markdown inventory into a styled Word (.docx) report: numbered table of contents, colour-coded severity tables, and 42 gap-analysis rules across MITRE ATT&CK, cost, and hygiene. Here's what's in it, and what the same day's other pushes mean.

Automation

Sentinel-As-Code: Wave 4, the docs nobody wanted to write

Nobody likes writing documentation. Even when you do write it, it starts dying the moment you save the file. Someone tweaks a setting in the portal, swaps a connector, changes a detection rule, and your carefully written workspace document is quietly drifting out of date for whoever reads it next.

SecDevOps

Sentinel-As-Code: Wave 3

Wave 2 closed with one specific promise: end-to-end Pester tests wired in as a PR gate, with branch protection on main so nothing merged without a green run. Wave 3 lands that gate, plus a handful of other things that took shape alongside it. The short list of

AzureDevOps

Sentinel-As-Code: Wave 2

About a year ago I published Automating Microsoft Sentinel Deployment, a three-stage pipeline that provisioned infrastructure via Bicep and deployed Content Hub solutions through a single PowerShell script. It worked, but it was limited. Last month I released Wave 1 of the 2026 rebuild, a ground-up rewrite focused

Automation

Sentinel Playbook Manager

One Script to rule them all, One Script to find them, One Script to bring them all, and in the SOC bind them. If you have ever tried to move a Microsoft Sentinel playbook from one tenant to another or from the portal into a Git repository you will know

Sentinel-As-Code: The 2026 Update

Deploy Your Entire Sentinel Environment from a Single Repo When I first pushed Sentinel-As-Code to GitHub in March 2025 with the subsiquent blog, it was a straightforward Bicep deployment tool — a couple of templates to stand up a Log Analytics workspace and onboard Sentinel. Useful, but limited. It

Life

It's Okay, Not Be Okay

Sometimes the hardest thing isn't what you're going through it's admitting you need help. There's no easy way to start this post. I've written and rewritten this several times now, trying to find the right words. But I think that&

ConsentFix: Securing Your Tenant Against OAuth Authorisation Code Theft

There's a new OAuth attack making the rounds that's caught the attention of security professionals. ConsentFix (sometimes called AuthCodeFix) exploits a design quirk in how Microsoft first-party applications handle OAuth flows, and it's very effective. There is a straightforward mitigation that takes about

AI

Becoming the Puppet Master of an AI SOC team

I released a Model Context Protocol server called KQL Search MCP last week. The idea was stop manually searching through GitHub repositories every time I needed a KQL query. It search thousands of queries from all GitHub repos, validates them against table schemas, and can even generate new queries from

AI Featured

Finding and Writing KQL Queries with the Model Context Protocol

If you work with Microsoft security products, you've probably spent time writing KQL queries. You might search through documentation, look at examples on GitHub, or copy queries from colleagues. KQL-Search-MCP Server makes this easier by bringing query search and generation directly into AI assistants like Claude

When Someone Beats You to It

I was planning to write up a blog for Sentinel Solutions MCP, but Marcus Burnap beat me to it – awesome work Marcus! I was reading through his post and it felt weirdly familiar. The tool he was describing, the functions, the approach... it all seemed similar to the tool I

Extending UniFi Monitoring in Microsoft Sentinel: Workbooks and Analytics Rules

In my previous article, we explored how to integrate UniFi network monitoring into Microsoft Sentinel using the Codeless Connector Framework. With data now flowing from the UniFi Site Manager API into your Sentinel workspace, the next step is to visualise that data and create automated detections. This article covers the

Integrating UniFi Network Monitoring into Microsoft Sentinel

If you're running a UniFi network and using Microsoft Sentinel for security operations, you've likely wondered how to bring your network infrastructure data into your SIEM. Until recently, this required custom solutions or third-party tools. With the release of the official UniFi Site Manager API,

AI

Trading Monthly Bills for One Catastrophic Payment

Featured

Reclaiming Privacy: A Complete Guide to Proton's Black Friday 2025 Offers

I'm part of Proton's affiliate program, which means I earn a small commission if you upgrade to a paid plan through my links. This supports OmniFetch (my iOS app) and helps maintain this blog. That said, my review of Proton's services is based purely

Automation

Automating the Automation

How I Automated Away My Inability to Explain What I Did!

AppDev

My Journey Building OmniFetch: A Personal Media Management App

DefenderXDR

Managing Microsoft Defender XDR Custom Detection Rules at Scale

Automating Microsoft Sentinel Deployment with GitHub Actions

Deploying Microsoft Sentinel resources manually can be time-consuming and error-prone. By leveraging GitHub Actions and Infrastructure as Code principles, we can automate the deployment of Sentinel solutions, analytical rules, and workbooks with a single push to our repository. This guide walks through setting up automated Sentinel deployment using

Automation

Sentinel Content Hub Updates: Why Manual Management Doesn't Scale

Managing Microsoft Sentinel Content Hub solutions and their associated analytics rules across multiple workspaces starts simple but quickly becomes overwhelming. What begins as deploying a few solution packages in a single workspace evolves into hours of repetitive portal navigation, ensuring consistent Content Hub deployments between environments, and inevitably missing critical

MicrosoftSentinel Featured

Microsoft Sentinel Data Lake: Revolutionising Security Analytics with Cost-Effective Long-Term Storage

Microsoft has unveiled an exciting development in cloud security: the Microsoft Sentinel Data Lake, currently in preview. This innovative solution promises to transform how organisations handle high-volume security data whilst significantly reducing operational costs. By decoupling storage from compute, Sentinel Data Lake offers unprecedented flexibility and economic efficiency for

KQL

Microsoft Sentinel Analytical Rule Tuning

Microsoft Sentinel's analytical rules form the backbone of your security operations centre's detection capabilities. However, deploying rules isn't enough. Effective rule tuning is essential for maintaining high detection accuracy whilst minimising alert fatigue. This comprehensive guide explores the critical aspects of Sentinel rule tuning

Automation

SentinelCodeGuard: A Journey from Concept to VS Code Plugin

When I first released SentinelCodeGuard v0.0.1 last month, it was a simple validation tool with a handful of basic features. Today, we are on v0.0.9 – a complete transformation that has evolved into a comprehensive development toolkit for Microsoft Sentinel Analytics Rules. Let me take you through

Automation

SentinelCodeGuard: Revolutionising Microsoft Sentinel Rule Development

A VS Code extension that transforms how security professionals create, validate, and manage Microsoft Sentinel analytics rules