Hey there 🖖 - Have you ever wondered how a managed kubernetes Control Plane can reach into your cluster and execute commands, stream logs, or call webhooks without having direct network access to y...

Hey there 🖖 - In this blog post, I want to introduce you to a preview feature that simplifies the ingestion of massive data into Sentinel by using Event Hub. Spoiler alert: In my opinion this i...

Hey there 🖖 - Ever wondered how the kubelet - the well known small node agent in Kubernetes - keeps tabs on what pods to deploy? I did too, and thus decided to have a deeper look on it. Initially, ...

Hey there 🖖 - In a recent project, I tackled a scenario where we aimed to enhance container network observability for Arc-enabled clusters deployed at customer edge sites to potentially utilize the...

Hi there! I was recently asked whether it’s possible to retrieve details about the actual commands executed via Azure VM Run Command when working with Microsoft Defender and Sentinel. Although ther...

Introduction Full KQL query can be found here GitHub NTA query. Similar query which makes use of ThreatIntelIndicators table instead of NTA built-in malicious flows to then also allow the mappi...

Came you also across the situation or requirement to log DNS queries from within Azure VNET? If yes, then this blog may be of interest for you. While this was not possible in the past without goi...