… and some other stuff to get you feeling nostalgic And now for something completely different I received quite some feedback on one of my more recent articles here on Medium. Not only did the community initiated pull request on my Github repository to improve the content inside, I also got quite a few questions about…

… and stop using SPNs and workspace keys Introduction One of the many great features of Microsoft Sentinel are its ‘SOAR’ capabilities. By using playbooks based on Azure Logic App technology we can automate a lot of tasks to improve the efficiency of our SOCs. I have already covered this topic…

The "Swiss army knife" is back! And better than ever! It's back! Already more than 2,5 years ago, I wrote about Logstash for the first time. Then I explained how you can leverage this versatile open-source tool to your benefits, in combination with Microsoft Sentinel, to ingest custom logs. Fun fact: Microsoft…

with Github Actions and Microsoft Sentinel 0ptimiz€r Introduction Earlier this year I've published a blog post about how to optimize your Microsoft Sentinel and Azure Log Analytics pricing tiers. I'f you're not yet fully familiar with how the different pricing tiers differ, and how they stack up, I'd suggest you'd give…

…and make the life of your security analysts, yet again, a little bit better Introduction When investigating security incidents in Microsoft Sentinel there will probably be a few entities related and attached as evidence. It can be very helpful to have additional information about each entity for your follow-up triage steps…

… by saving them inside a 'query pack' Introduction As a security analyst, responsible for performing triage as part of incident response, you're performing similar tasks quite regularly. Like checking a user by determining from where they logged on, how, and with what device as an example. When you're using Microsoft…

with Sentinel Archive and the new custom logs ingestion API [part 2/2] Welcome back! I’ve recently wrote an article about Microsoft Sentinel Basic and Archive logs and the new custom log ingestion API with Data Collection Endpoint. That was the first part in a series of two. In this second part we’re…

to extend retention of 365 Defender logs past the 30 day limit! [part 1/2] Introduction I regularly get asked questions about data retention in Microsoft Sentinel. Some customers want a longer data retention than previously possible within Log Analytics for compliance requirements. Others might have table-specific needs for storing data. And…