Security Automation Blog

Practical Microsoft Sentinel, Defender XDR, and MISP guides focused on detection engineering, log strategy, and automation.

Browse field-tested walkthroughs on security monitoring architecture, cost optimization, threat intelligence pipelines, and practical detection engineering.

Browse all posts in chronological order

Popular Reads

These are currently the most visited posts on the site.

Migrating Microsoft Sentinel to Defender XDR: What to Expect

A practical breakdown of the Microsoft Sentinel to Defender XDR migration, including architecture impact, correlation behavior, and planning considerations.

Defender XDR Custom Detection Rules via Graph API

Create and manage Defender XDR custom detection rules through Microsoft Graph API with payload patterns, limits, and caveats.

PowerShell Module for Defender XDR Custom Detection Rules

Use a PowerShell module to manage Defender XDR custom detection rules via Graph API with support for impacted assets, response actions, and SPN auth.

Entra ID Privileged Access: Practical PIM Implementation

Implement Entra ID privileged access controls with PIM, role hygiene, and operational guardrails for high-impact accounts.

SinkVPN Testing: Can a Rogue VPN Silence Defender for Endpoint?

A lab-based walkthrough testing SinkVPN techniques against Defender for Endpoint telemetry using a rogue VPN setup and controlled routing.

Microsoft Sentinel Log Baseline: Cost vs Detection Value

Build a practical Sentinel log baseline by mapping data sources to detection value, cost tiering, and operational outcomes.

Curated Topic Clusters

Start here if you want a focused reading path by topic.

Sentinel Cost and Data Strategy

Cost control, retention choices, and data-tier planning for real-world Sentinel operations.

  1. Practical Log Baseline
  2. Cost Estimation Methods
  3. Sentinel Data Lake FAQ
  4. Smart DCRs from Analytics
  5. Threat Modelling and Data Sources

Detection Engineering and XDR Operations

Detection design, custom rule operations, and Defender XDR execution patterns.

  1. Practical Detection Engineering
  2. Custom Detection Rules API
  3. PowerShell Module for CDR
  4. Actions from Advanced Hunting
  5. Sentinel to Defender Migration

MISP and Threat Intelligence Pipelines

Threat intel ingestion, pipeline hardening, and MISP-to-Sentinel implementation patterns.

  1. Push TI from MISP
  2. misp2sentinel Update
  3. RustyMISP2Sentinel
  4. MISP Filter Builder
  5. Upload Indicators API Tool
  6. Threat Intelligence in Detection