Device Code Phishing: How Storm-2372 Bypasses MFA
How Storm-2372 exploits device code flows to bypass MFA. Covers attack steps, Conditional Access mitigations, and KQL detections for Microsoft XDR.
Security with Tom
Optimize your SOC with SIEM and XDR Recommendations
Optimize your SOC with the unified SIEM and XDR coverage view in Microsoft Defender: MITRE-mapped recommendations, threat scenarios, and detection gaps.
Bringing Microsoft Sentinel Workbooks to the Microsoft XDR Portal
Microsoft Sentinel workbooks are now available in the Defender XDR portal. What this unified experience means for your SOC and how to make use of it.
Upload your analytic rules to Azure Devops
Store your Microsoft Sentinel analytic rules in Azure DevOps: convert YAML detections to JSON and set up a repository ready for automated deployment.
Generate ready to use analytic rules
Use a PowerShell script to convert Microsoft Sentinel analytic rules from YAML to ARM JSON, generating ready to deploy detection rules in minutes.
Manage permissions for Microsoft Sentinel across Multiple Environments with Lighthouse
Use Azure Lighthouse to manage Microsoft Sentinel permissions across multiple tenants from one place, with ARM templates and least-privilege roles.
Monitor and Respond to Security Threats with Azure Sentinel
How Azure Sentinel helps you monitor and respond to security threats: analytic rules, alert enrichment, automation, and community content to get started.
Start defending, but watch your DNS
Defending your Microsoft environment starts outside it: how SPF records protect your mail domain from spoofing and what to check in your DNS today.
Infrastructure as Code
Get started with Infrastructure as Code in Azure: what ARM templates are, how they work, and a step-by-step first deployment of a storage account.
The Kusto Detective Agency
Learn KQL the fun way with the Kusto Detective Agency: how to onboard, load the sample data, and solve your first Kusto Query Language challenge.