Aug 11Ingest your logs into Azure Data Explorer with LogstashIs this a better alternative to Sentinel Basic logs? Introduction While creating solutions based on Azure Data Explorer recently, I've discovered that this resource can be quite a valuable companion to use alongside Microsoft Sentinel. …Logstash6 min readLogstash6 min read
Jun 7Unlimited Advanced Hunting for Microsoft 365 Defender with Azure Data Explorer – Part IIIntroduction A month ago I've published an article about extending your Microsoft 365 Defender logs beyond the default of 30 days by leveraging Azure Event Hubs and Azure Data Explorer. I promised a second part to that article where I want to zoom in on sizing, performance and cost considerations. If…Microsoft Defender16 min readMicrosoft Defender16 min read
Mar 30Unlimited Advanced Hunting for Microsoft 365 Defender with Azure Data ExplorerIntroduction More and more customers ask me what the options are to extend the retention in Microsoft 365 Defender beyond the default 30 days. Data like incidents, alerts and event timelines of devices remain available for 180 days. But in this particular case they’re referring to the Advanced Hunting data being…Microsoft 365 Defender15 min readMicrosoft 365 Defender15 min read
Jan 26Secure your Logstash connections to Microsoft Sentinelby implementing automatic key rotation with "Rot8r" Introduction People who work with me, and/or read my articles here on Medium, already know this: I’m a big fan of Elastic’s Logstash. I regularly called it a "Swiss Army knife" due to its versatility and capabilities, and already wrote several articles about implementing…Logstash9 min readLogstash9 min read
Dec 21, 2022🎁 HOLiDAY SPECiAL 🎄 From ANSi to nerd fonts…… and some other stuff to get you feeling nostalgic And now for something completely different I received quite some feedback on one of my more recent articles here on Medium. …Ansi14 min readAnsi14 min read
Dec 13, 2022Secure your Microsoft Sentinel playbooks with managed identities… and stop using SPNs and workspace keys Introduction One of the many great features of Microsoft Sentinel are its ‘SOAR’ capabilities. By using playbooks based on Azure Logic App technology we can automate a lot of tasks to improve the efficiency of our SOCs. …Microsoft Sentinel12 min readMicrosoft Sentinel12 min read
Dec 9, 2022Ingest DCR-based custom logs in Microsoft Sentinel with LogstashThe "Swiss army knife" is back! And better than ever! It's back! Already more than 2,5 years ago, I wrote about Logstash for the first time. Then I explained how you can leverage this versatile open-source tool to your benefits, in combination with Microsoft Sentinel, to ingest custom logs. Fun fact: Microsoft…Logstash11 min readLogstash11 min read
Nov 18, 2022Auto-scale your Sentinel pricing tierswith Github Actions and Microsoft Sentinel 0ptimiz€r Introduction Earlier this year I've published a blog post about how to optimize your Microsoft Sentinel and Azure Log Analytics pricing tiers. …Azure9 min readAzure9 min read
Aug 3, 2022Add Azure tags from evidence to your Sentinel incidents…and make the life of your security analysts, yet again, a little bit better Introduction When investigating security incidents in Microsoft Sentinel there will probably be a few entities related and attached as evidence. It can be very helpful to have additional information about each entity for your follow-up triage steps…Azure Tags5 min readAzure Tags5 min read
Jul 13, 2022Bring your investigation queries with you across multiple workspaces… by saving them inside a 'query pack' Introduction As a security analyst, responsible for performing triage as part of incident response, you're performing similar tasks quite regularly. Like checking a user by determining from where they logged on, how, and with what device as an example. When you're using Microsoft…Azure5 min readAzure5 min read
