Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
hachyderm.io is one of the many independent Mastodon servers you can use to participate in the fediverse.
Hachyderm is a safe space, LGBTQIA+ and BLM, primarily comprised of tech industry professionals world wide. Note that many non-user account types have restrictions - please see our About page.

Administered by:

Server stats:

8.9K
active users

hachyderm.io: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.8

#MicrosoftSentinel

2 posts2 participants0 posts today
Public
Fringed Crow :battery_ok:
My Feedly seems to be broken. Can't mark anything as read. Ugh! Flip side, does anyone know a query for Microsoft Sentinel or a way to determine a massive spike in data logs? All i get is "CommonSecurityLogs" but haven't found away to determine the source of the spike. Device or devices, etc. Anyone that uses Azure/Intune have some thoughts? #MicrosoftAzure #MicrosoftSentinel #UsageandCost
Public *
Will Hunt

Only 5 days to go until our both our Hacking Enterprises and Defending Enterprises training classes kick off at Black Hat USA.

There's still time to snag yourself a ticket for either the weekend or weekday delivery and we'd love to help level up your skills in either offensive or defensive techniques, or both!

Wreak havoc with in our multi-domain enterprise environment and then hunt, detect, monitor and alert after, or vice versa!

in.security/events/

In.securityUpcoming Events - In.security
#pentesting#redteam#hacking
Public
Michalis Michalos

📢 New blog post out!

Five reasons to start using Microsoft Defender Threat Intelligence (Basic)

➡️ While MDTI Basic license comes with limited capacity, it is undeniably a valuable resource to consider operationalizing in your daily tasks and incorporating it in your TI processes.

➡️ Join me in exploring 5 (plus 1!) reasons, why and how you can operationalize MDTI in your Cyber Threat Intelligence capacity.

🔗 michalos.net/2024/07/23/five-r

Michalis Michalos · Five reasons to start using Microsoft Defender Threat Intelligence (Basic)Introduction Curated feed with IoCs Threat Analytics Tracked Threat Actors (with tools & vulnerabilities) Intel Explorer, your contextualized daily news feed Intel projects A bonus reason to co…
#Microsoft#MicrosoftSecurity#MicrosoftDefender
Public
Will Hunt

Less than a month to go until Black Hat USA 👀. I suppose the only thing to say is I look forward to seeing you on either our Hacking Enterprises or Defending Enterprises trainings, or maybe both!

...and if I don't, I suppose the only question to ask is, why haven't your bought your ticket yet? 😎 From phishing, C2, IPv6 and rampaging through multi-domain trusts, to deep threat hunting, monitoring and alerting in our Sentinel lab - I suppose the REAL question is, how many friends or colleagues are signing up with you?!

in.security/events/

In.securityUpcoming Events - In.security
#pentesting#hacking#redteam
Continued thread
Public
Mehmet Ergene

🔍 Advanced Time Series Anomaly Detection: Discover methods you’ve never seen before.
🔗 Attack Path & Execution Chain Detection with Process Mining: A novel approach to threat detection.
🌐 Attack Pattern Detection Using Graph Semantics: Start thinking in graphs and revolutionize your detection and investigation skills.

academy.bluraven.io/advanced-h

#KQL#Kusto#SIEM
Public
Gareth Emslie 🇿🇦 🇪🇦 🇨🇭

This article provides a guide on how to create and debug Microsoft Sentinel Analytic Rules, Automation Rules, and playbooks. It includes steps on creating a playbook, creating a sample Analytic rule for testing, creating an Automation rule, and debugging the playbook. techcommunity.microsoft.com/t5

TECHCOMMUNITY.MICROSOFT.COMDebugging PlaybooksMicrosoft Sentinel playbooks use Azure Logic Apps behind the scenes to perform workflow automation.  While they are powerful, they can be hard to debug when..
Public
Michalis Michalos

📢 New blog out!

💡 If you isolate an endpoint during IR, you probably don't have time to notify stakeholders like the help desk that might be reached out for troubleshooting by the user. This logic app is based on #KQL and identifies the isolation action, adds a tag for your #DefenderXDR portal and sends an email.

#MicrosoftSecurity #MicrosoftSentinel #MicrosoftDefender #LogicApps #MicrosoftAutomation #Automation #AdvancedHunting

michalos.net/2024/02/20/isolat

Michalis Michalos · Isolated an Endpoint? Automate tag adding and notificationsIf you are part of a big organization, you might need to reach out to some colleagues and teams, in case you isolate an endpoint. An end user will probably reach out to your help desk in order to i…
ExploreLive feeds
About