An empty Microsoft Sentinel workspace is a bit of a blank canvas problem - great if you’re starting fresh, less useful when you’re trying to demonstrate detection logic, run a CTF, or help an analy...

Governance rules in Defender for Cloud are a great way to drive remediation accountability - but when owners go stale (people leave, addresses change), cleaning them up through the portal quickly b...

Microsoft Defender Endpoint’s standard (active) discovery probes hosts on the local subnet but it can be surprisingly difficult to trace, since it happens only once every three weeks. The good news...

If you run VMs on Hyper-V using the default NAT switch, capturing their network traffic is trivial - just open Wireshark on the host and you’re done. Switch to an external vSwitch backed by a dedic...

Hey there 🖖 - Have you ever wondered how a managed kubernetes Control Plane can reach into your cluster and execute commands, stream logs, or call webhooks without having direct network access to y...

Hey there 🖖 - In this blog post, I want to introduce you to a preview feature that simplifies the ingestion of massive data into Sentinel by using Event Hub. Spoiler alert: In my opinion this i...

Hey there 🖖 - Ever wondered how the kubelet - the well known small node agent in Kubernetes - keeps tabs on what pods to deploy? I did too, and thus decided to have a deeper look on it. Initially, ...

Hey there 🖖 - In a recent project, I tackled a scenario where we aimed to enhance container network observability for Arc-enabled clusters deployed at customer edge sites to potentially utilize the...

Hi there! I was recently asked whether it’s possible to retrieve details about the actual commands executed via Azure VM Run Command when working with Microsoft Defender and Sentinel. Although ther...

Introduction Full KQL query can be found here GitHub NTA query. Similar query which makes use of ThreatIntelIndicators table instead of NTA built-in malicious flows to then also allow the mappi...