Was catching up on the Defender for Identity what’s-new page the other day and kept scrolling. And scrolling. New alert after new alert, month after month. What’s-new changelog: https://learn.m...
In my previous post, Ingestion into Sentinel via Event Hub made simple, I walked through the Azure Monitor preview feature that allows a Data Collection Rule (DCR) to consume directly from Event Hu...
Local AI agents are becoming normal developer and operator tooling. GitHub Copilot CLI, Claude Code, desktop agents, MCP-connected tools, and similar assistants do not just generate text anymore. T...
An empty Microsoft Sentinel workspace is a bit of a blank canvas problem - great if you’re starting fresh, less useful when you’re trying to demonstrate detection logic, run a CTF, or help an analy...
Governance rules in Defender for Cloud are a great way to drive remediation accountability - but when owners go stale (people leave, addresses change), cleaning them up through the portal quickly b...
Microsoft Defender Endpoint’s standard (active) discovery probes hosts on the local subnet but it can be surprisingly difficult to trace, since it happens only once every three weeks. The good news...
If you run VMs on Hyper-V using the default NAT switch, capturing their network traffic is trivial - just open Wireshark on the host and you’re done. Switch to an external vSwitch backed by a dedic...
Hey there 🖖 - Have you ever wondered how a managed kubernetes Control Plane can reach into your cluster and execute commands, stream logs, or call webhooks without having direct network access to y...
Hey there 🖖 - In this blog post, I want to introduce you to a preview feature that simplifies the ingestion of massive data into Sentinel by using Event Hub. Spoiler alert: In my opinion this i...
Hey there 🖖 - Ever wondered how the kubelet - the well known small node agent in Kubernetes - keeps tabs on what pods to deploy? I did too, and thus decided to have a deeper look on it. Initially, ...