Exploring artifacts of a desired state to build health checks with limited access
A short look how we can use existing access to tools like Microsoft Sentinel to build desired state configuration checks.
Read more →
Security Automation Blog
Practical Microsoft Sentinel, Defender XDR, and MISP guides focused on detection engineering, log strategy, and automation.
Browse field-tested walkthroughs on security monitoring architecture, cost optimization, threat intelligence pipelines, and practical detection engineering.
Popular Reads
These are currently the most visited posts on the site.
Migrating Microsoft Sentinel to Defender XDR: What to Expect
A practical breakdown of the Microsoft Sentinel to Defender XDR migration, including architecture impact, correlation behavior, and planning considerations.
Defender XDR Custom Detection Rules via Graph API
Create and manage Defender XDR custom detection rules through Microsoft Graph API with payload patterns, limits, and caveats.
PowerShell Module for Defender XDR Custom Detection Rules
Use a PowerShell module to manage Defender XDR custom detection rules via Graph API with support for impacted assets, response actions, and SPN auth.
Latest Posts
The three most recent posts from the site.
Exploring artifacts of a desired state to build health checks with limited access
Learn an artifact-based architecture pattern for verifying Microsoft Sentinel UEBA state with limited RBAC access. Use existing SPN permissions (Log Analytics Contributor + Sentinel Contributor) to validate desired state without adding new privileges.
OpenTelemetry from coding agents to Azure Monitor
How OpenTelemetry works end-to-end, and one concrete way to ship logs from coding agents (VS Code Copilot, Claude Code) into Application Insights / Log Analytics via a collector in Azure Container Apps.
Microsoft Sentinel Usage Table Plan Field: KQL Queries for Cost Analysis
Use the Plan field in the Usage table to break down Microsoft Sentinel ingestion by Analytics, Basic, and Auxiliary with practical KQL queries.
Curated Topic Clusters
Start here if you want a focused reading path by topic.
Sentinel Cost and Data Strategy
Cost control, retention choices, and data-tier planning for real-world Sentinel operations.
Detection Engineering and XDR Operations
Detection design, custom rule operations, and Defender XDR execution patterns.
MISP and Threat Intelligence Pipelines
Threat intel ingestion, pipeline hardening, and MISP-to-Sentinel implementation patterns.
All Posts
Everything on the blog, with tag filtering if you want to narrow it down.
Configure Windows Defender Firewall (part 2)
Securing Windows Server - Chapter 3, Part 2
Read more →