Automation - sentinel.blog

sentinel.blog

Sign in Subscribe

Automation

A collection of 14 posts

Finding and Writing KQL Queries with the Model Context Protocol

If you work with Microsoft security products, you've probably spent time writing KQL queries. You might search through documentation, look at examples on GitHub, or copy queries from colleagues. KQL-Search-MCP Server makes this easier by bringing query search and generation directly into AI assistants like Claude Desktop, GitHub

Automating the Automation

Sentinel Content Hub Updates: Why Manual Management Doesn't Scale

Managing Microsoft Sentinel Content Hub solutions and their associated analytics rules across multiple workspaces starts simple but quickly becomes overwhelming. What begins as deploying a few solution packages in a single workspace evolves into hours of repetitive portal navigation, ensuring consistent Content Hub deployments between environments, and inevitably missing critical

SentinelCodeGuard: A Journey from Concept to VS Code Plugin

When I first released SentinelCodeGuard v0.0.1 last month, it was a simple validation tool with a handful of basic features. Today, we are on v0.0.9 – a complete transformation that has evolved into a comprehensive development toolkit for Microsoft Sentinel Analytics Rules. Let me take you through

SentinelCodeGuard: Revolutionising Microsoft Sentinel Rule Development

A VS Code extension that transforms how security professionals create, validate, and manage Microsoft Sentinel analytics rules

Automation Featured

Simplifying Azure Log Analytics Table Retention Management: A Modern Approach

The Challenge: Retention Management at Scale If you've ever managed Azure Log Analytics workspaces at enterprise scale, you'll know the pain of manually configuring retention policies across dozens—or even hundreds—of tables. The Azure portal, whilst functional, becomes cumbersome when you need to update retention

Part 1 - Modularising Logic Apps: Building Reusable Cloud Automation Solutions

Introduction Did you know you can call Logic Apps from other Logic Apps? This powerful capability truly transforms how you build cloud automation solutions! In the evolving landscape of cloud automation, Microsoft's Logic Apps stand out as a powerful solution for creating integrated workflows with minimal code. As

Breach Defence Automation: Creating Your Hybrid Account Kill Switch with Microsoft Sentinel and Logic Apps

In cybersecurity, response time is everything. When a suspicious user account is detected, every second counts. Today, I'm sharing a comprehensive security automation tool I've built using Logic Apps to respond to Microsoft Sentinel incidents by automatically disabling compromised accounts across both Entra ID and on-premises

Building an Automated Sentinel Incident Reporting System with Azure Logic Apps

Sentinel Alerts to Actionable Insights: Streamlining Security Incident Communication with Power-Packed Logic Apps

Automation Featured

Bonus - The Growing Threat of Token Theft: How Attackers Exploit Stolen Authentication After Successful Phishing

Introduction This is special bonus content in our six-part series on phishing attacks and defences. Part 1 provided an overview of the series, Part 2 explored various phishing attack types, and Part 3 examined the advanced phishing framework Evilginx. Successfully obtaining credentials through phishing is rarely the ultimate goal for

Automating Security: Creating Microsoft Sentinel Watchlists from Entra ID Group Membership

Automating Sentinel Watchlists with Entra ID Groups and Logic Apps

Simplifying Microsoft Logic App Exports: A Powerful Tool for DevOps Teams

Export Logic Apps with Ease: One Script to Rule All Environments!

Automate Microsoft Sentinel Updates: A Complete PowerShell Toolkit

Security at Scale: Sentinel Updates Without the Hassle!

MicrosoftSecurity

Automating Entra ID App Registration Credential Monitoring: A Complete Solution

Credential Watch: Stay Ahead, Stay Secure

Social Media Footer