A Guide to Presenting Stuff, sort of
A semi-practical guide to how presenting better helps you learn, whether you're on stage, in a meeting, or just trying to explain a technical idea clearly.
Read more →
Security Automation Blog
Practical Microsoft Sentinel, Defender XDR, and MISP guides focused on detection engineering, log strategy, and automation.
Browse field-tested walkthroughs on security monitoring architecture, cost optimization, threat intelligence pipelines, and practical detection engineering.
Popular Reads
These are currently the most visited posts on the site.
Migrating Microsoft Sentinel to Defender XDR: What to Expect
A practical breakdown of the Microsoft Sentinel to Defender XDR migration, including architecture impact, correlation behavior, and planning considerations.
Defender XDR Custom Detection Rules via Graph API
Create and manage Defender XDR custom detection rules through Microsoft Graph API with payload patterns, limits, and caveats.
PowerShell Module for Defender XDR Custom Detection Rules
Use a PowerShell module to manage Defender XDR custom detection rules via Graph API with support for impacted assets, response actions, and SPN auth.
Latest Posts
The three most recent posts from the site.
A Guide to Presenting Stuff, sort of
A semi-practical guide to how presenting better helps you learn, covering structure, storytelling, practice, and finding your own style as a speaker.
Log Horizon tutorial: How to improve Microsoft Sentinel posture
This Log Horizon tutorial teaches you how to evaluate Microsoft Sentinel tables by cost and detection coverage to identify waste, missing coverage, and optimization opportunities.
Log Horizon Update 0.5.0: HTML Export, Transform Insights, and Hardening
This Log Horizon update covers versions 0.2.1 to 0.5.0 with self-contained HTML reports, full KQL transform visibility, retention and correlation analysis, security fixes, and expanded Pester coverage.
Curated Topic Clusters
Start here if you want a focused reading path by topic.
Sentinel Cost and Data Strategy
Cost control, retention choices, and data-tier planning for real-world Sentinel operations.
Detection Engineering and XDR Operations
Detection design, custom rule operations, and Defender XDR execution patterns.
MISP and Threat Intelligence Pipelines
Threat intel ingestion, pipeline hardening, and MISP-to-Sentinel implementation patterns.
All Posts
Everything on the blog, with tag filtering if you want to narrow it down.
Configure Windows Defender Firewall (part 2)
Securing Windows Server - Chapter 3, Part 2
Read more →