Tool Release: rustymisp2sentinel
#Analytic Rules#Microsoft Sentinel#Powershell
Archive
74 posts in total
2026 (8 posts)
Make some noise - a note on detections
#Detection Engineering#Security Monitoring
Testing the SinkVPN-concept to silence EDRs
#Security Monitoring#EDR#Powershell
Tool Release: misp-filter-builder
#MISP#Microsoft Sentinel#Threat Intelligence
Could you build a simple C2-framework using World of Warcraft?
#Cyber Security#C2
Disable correlation for Analytic Rules in Microsoft Sentinel
#Analytic Rules#Microsoft Sentinel#Powershell
Migrating Microsoft Sentinel to Microsoft Defender XDR
#Cyber Security#Security Monitoring#Microsoft Sentinel
Tool Release: DarkLighthouse
#Cyber Security#PowerShell#Azure
2025 (13 posts)
This can't possibly work - building a detection engineering assistant
#SIEM#XDR#Custom detection rules
Lab - Defender for IoT configuration
#Lab#Defender for IoT#Microsoft Sentinel
Lab - Setting up Hyper-V host
#Lab#Hyper-V
Defender for Endpoint - Custom Data Collection Rules
#Microsoft Defender XDR#Advanced Hunting#Detection Engineering
Practical Detection Engineering
#Microsoft Defender XDR#Advanced Hunting#Custom Detection Rules
Microsoft Defender XDR - Take action on advanced hunting results
#Microsoft Defender XDR#Advanced Hunting
Microsoft Sentinel Data Lake - FAQ
#Microsoft Sentinel#Microsoft Defender XDR#Graph API
How to not mess up your Microsoft Sentinel deployment
#Microsoft Sentinel#Microsoft Defender XDR#Graph API
Defender XDR - Custom Detection Rules Push/Pull via API
#Microsoft Defender XDR#Graph API#Custom Detection Rules
Azure Spring Clean - Maestering Azure Tenant Security
#Cyber Security#Entra ID#Maester
Workspace Transformation Rules in Practice
#Cyber Security#Microsoft Sentinel#Azure
Expanding on Cyber Threat Intelligence for Security Monitoring
#Cyber Security#Security Monitoring#Threat Intelligence
On the use of Threat Intelligence in Detection
#Cyber Security#Security Monitoring#Threat Intelligence
2024 (15 posts)
Tool Release: pwshuploadindicatorsapi
#Cyber Security#PowerShell#Threat Intelligence
Tool Release: pwshmisp
#Cyber Security#PowerShell#Threat Intelligence
Test Yourself Part 1: Identity
#Cyber Security#Entra ID#Security Monitoring
Hardening Entra ID
#Microsoft Sentinel#Entra ID#Hardening
Security Monitoring - Threat Modeling and Data Sources
#Security Monitoring#Data and logging#SIEM
Security Monitoring Antipatterns
#Cyber Security#Security Architecture#Antipatterns
Adding Graph API permissions to Managed Identities
#Nice to know#Entra ID#Azure
5 Years On - The Microsoft Sentinel Experience
#Cyber Security#Security Monitoring#Microsoft Sentinel
Test Yourself: The Prelude
#Cyber Security#Entra ID#Security Monitoring
Authenticate to Azure DevOps using Managed Identity and REST API
#Entra ID#Azure#Managed Identity
Download Azure DevOps Repositories using a Managed Identity and REST API
#Nice to know#Entra ID#Azure
Tools You Should Know: ScubaGear
#Cyber Security#Entra ID#Security Monitoring
Automating Security Monitoring - Part 2: Automation
#Microsoft Sentinel#Automation#SOAR
Automating Security Monitoring - Part 1: Data
#Microsoft Sentinel#Automation#SOAR
Christmas Wrappers - Part 2
#PowerShell#Cyber Security#MISP
2023 (11 posts)
Christmas Wrappers - Part 1
#PowerShell#Cyber Security#MISP
Security Monitoring - Developing Use Cases
#Cyber Security#Security Monitoring#SIEM
Figuring out MISP2Sentinel Event Filters
#MISP#Threat Intelligence#Microsoft Sentinel
Use Update Indicators API to push Threat Intelligence from MISP to Microsoft Sentinel
#Cloud Security#Microsoft Sentinel#Data and logging
Pushing Threat Intelligence from MISP to Microsoft Sentinel
#Cloud Security#Microsoft Sentinel#Data and logging
Increasing the default timeout of Azure Functions
#Cloud Security#Microsoft Sentinel#Data and logging
Removing orphaned Azure resource assigments
#Cloud Security#Azure#IAM
Microsoft Sentinel Workspace Manager
#Cloud Security#Microsoft Sentinel#Workspace Manager
Field notes on security strategy
#Cloud Security#Microsoft Sentinel#Data and logging
Azure Lighthouse access design considerations
#Azure#Azure Lighthouse#ARM Templates
Cost estimation in Microsoft Sentinel
#Cloud Security#Microsoft Sentinel#Data and logging
2022 (13 posts)
I want you to steal my job
#Cloud Security#Azure DevOps#PowerShell
Design an MSSP access strategy for Microsoft Sentinel
#Cloud Security#Azure Lighthouse#Privileged Identity Management
Simple security in Azure DevOps pipelines
#Cloud Security#Azure DevOps#Webhook triggers
IP Allowlisting in Microsoft Sentinel Playbooks
#Cloud Security#Microsoft Sentinel#Playbooks
Enable Defender for DevOps in Azure DevOps pipelines
#Cloud Security#Defender for Cloud#Defender for DevOps
Creating smart Data Collection Rules by parsing EventIDs from Analytic Rules
#Microsoft Sentinel#Active Directory#Azure Monitor Agent
Azure Lighthouse 101
#Azure#Azure Lighthouse#ARM Templates
Templating Microsoft Sentinel Analytic Rules using Powershell and CI/CD pipelines
#Microsoft Sentinel#Azure DevOps#Analytic Rules
Adding a Key Vault to your Microsoft Sentinel Data Connector ARM-template
#Microsoft Sentinel#ARM Templates#Azure Functions
Hardening Azure Active Directory
#Microsoft Sentinel#Azure Active Directory#Hardening
Auditing Microsoft Sentinel queries in an Azure Lighthouse-environment
#Microsoft Sentinel#Azure Lighthouse#LAQueryLogs
Assign roles to managed identities in Microsoft Sentinel playbooks using Azure Lighthouse
#Azure REST API#Microsoft Sentinel#Azure Lighthouse
Create Managed Identity and assign roles using Azure Lighthouse
#Azure REST API#Microsoft Sentinel#Azure Lighthouse
2021 (3 posts)
Deploying Automation Rules via API
#Azure REST API#Microsoft Sentinel#SecurityInsights
Practical Hacking
#Hacking#HackTheBox
2019 (5 posts)
Building a function
#PowerShell
Configure Windows Defender Firewall (part 2)
#PowerShell#Cyber Security#Windows
Configure Windows Defender Firewall
#PowerShell#Cyber Security#Windows
Implement shielded and encryption supported VMs
#PowerShell#Cyber Security#Windows
2018 (6 posts)
Implement a Guarded Fabric solution
#PowerShell#Cyber Security#Windows
Protect credentials and create security baselines
#PowerShell#Cyber Security#Windows
Implement server patching, updating solutions and malware protection
#PowerShell#Cyber Security#Windows
Disk and file encryption
#PowerShell#Cyber Security#Windows
Securing Windows Server (70-744) scripts
#PowerShell#Cyber Security#Windows
Reading SecureString credentials as cleartext
#PowerShell#GetNetworkCredential