Shahzaib Sajid·8h agoThe 60-70% False Positive Cut Wasn’t a Magic RuleWhat I learned about detection engineering after months of tuning SIEM alerts in an MSSP SOC
Alan Conlon·2d agoHunting Impossible Travel in Sentinel with KQLHere’s a sign-in pattern that should never happen. An account authenticates from Dublin at nine in the morning, then from São Paulo forty…
Victor Olawale·2d agoDetecting Lateral Movement in Windows Environments: Using Microsoft Defender, Sysmon, and KQL to…Compromising one computer does not always mean an attacker has achieved their objective.
Vaasudev·3d agoBuilding a Detection-as-Code Pipeline for Microsoft Sentinel (Part 3): Native Sentinel Repositories…In the first two parts of this series, I built a custom Detection-as-Code pipeline for Microsoft Sentinel.
CipherX9F Security·3d agoHow to ingest Windows Event Logs into Microsoft Sentinel with Azure Arc, AMA and XPath?Hands-on lab notes: a Windows 11 machine, onboarded with Azure Arc, sending Application, System, Setup and Security logs to Sentinel…
Bindiya Priyadarshini·6d agoHunting the SAP Execution GapWhy SAP-only detections miss the boundary layer, and five cross-domain Sentinel + Defender hunts, plus an explainable risk notebook, that…A response icon2A response icon2
CipherX9F Security·Oct 27How I Built a Secure Azure Web Application Using Key Vault, Managed Identity, Azure SQL and…Why I built this lab
Bindiya Priyadarshini·Oct 26The Patch Is Not the Proof: AWS EditionHunting PHP2Shell across AWS from Defender XDR, in KQLA response icon3A response icon3
edgar·Oct 26Simulating attacks with Atomic Red Team and mapping to MITRE ATT&CK (Part 3)Part 3 of the Sentinel lab series. Part 2 covered writing a detection rule for RDP brute force (T1110).
