MicrosoftSentinel - sentinel.blog

sentinel.blog

Sign in Subscribe

MicrosoftSentinel

A collection of 12 posts

MicrosoftSentinel Featured

Microsoft Sentinel Data Lake: Revolutionising Security Analytics with Cost-Effective Long-Term Storage

Microsoft has unveiled an exciting development in cloud security: the Microsoft Sentinel Data Lake, currently in preview. This innovative solution promises to transform how organisations handle high-volume security data whilst significantly reducing operational costs. By decoupling storage from compute, Sentinel Data Lake offers unprecedented flexibility and economic efficiency for security

Microsoft Sentinel Analytical Rule Tuning

Microsoft Sentinel's analytical rules form the backbone of your security operations centre's detection capabilities. However, deploying rules isn't enough. Effective rule tuning is essential for maintaining high detection accuracy whilst minimising alert fatigue. This comprehensive guide explores the critical aspects of Sentinel rule tuning

SentinelCodeGuard: A Journey from Concept to VS Code Plugin

When I first released SentinelCodeGuard v0.0.1 last month, it was a simple validation tool with a handful of basic features. Today, we are on v0.0.9 – a complete transformation that has evolved into a comprehensive development toolkit for Microsoft Sentinel Analytics Rules. Let me take you through

Leveraging Summary Rules in Microsoft Sentinel: A Practical Guide

Introduction In today's security landscape, organisations face an overwhelming volume of security data. Microsoft Sentinel, as a cloud-native SIEM solution, processes vast amounts of logs daily. However, the sheer volume can impact both performance and cost-efficiency. This is where Summary Rules come into play—a powerful feature that

Part 1 - Modularising Logic Apps: Building Reusable Cloud Automation Solutions

Introduction Did you know you can call Logic Apps from other Logic Apps? This powerful capability truly transforms how you build cloud automation solutions! In the evolving landscape of cloud automation, Microsoft's Logic Apps stand out as a powerful solution for creating integrated workflows with minimal code. As

MicrosoftSecurity

Part 5 - Advanced Phishing Detection and Response with Microsoft Sentinel and the Unified SOC

This is Part 5 of our six-part series on phishing attacks and defences. Part 1 provided an overview of the series, Part 2 explored various phishing attack types, Part 3 examined advanced phishing frameworks, our bonus content delved into post-exploitation techniques, and Part 4 covered comprehensive protection strategies. Despite our

Breach Defence Automation: Creating Your Hybrid Account Kill Switch with Microsoft Sentinel and Logic Apps

In cybersecurity, response time is everything. When a suspicious user account is detected, every second counts. Today, I'm sharing a comprehensive security automation tool I've built using Logic Apps to respond to Microsoft Sentinel incidents by automatically disabling compromised accounts across both Entra ID and on-premises

Building an Automated Sentinel Incident Reporting System with Azure Logic Apps

Sentinel Alerts to Actionable Insights: Streamlining Security Incident Communication with Power-Packed Logic Apps

Automating Security: Creating Microsoft Sentinel Watchlists from Entra ID Group Membership

Automating Sentinel Watchlists with Entra ID Groups and Logic Apps

Simplifying Microsoft Logic App Exports: A Powerful Tool for DevOps Teams

Export Logic Apps with Ease: One Script to Rule All Environments!

Automate Microsoft Sentinel Updates: A Complete PowerShell Toolkit

Security at Scale: Sentinel Updates Without the Hassle!

SecDevOps Featured

Automating Microsoft Sentinel Deployment with Azure DevOps CI/CD

Revolutionise Your Microsoft Sentinel Deployments!

Social Media Footer