Required claims for GitHub flexible federated identity credentials
Microsoft Entra requires GitHub expressions to match sub and compare repository_id or repository_owner_id with eq.
Read more →
Security Automation Blog
Practical Microsoft Sentinel, Defender XDR, and MISP guides focused on detection engineering, log strategy, and automation.
Browse field-tested walkthroughs on security monitoring architecture, cost optimization, threat intelligence pipelines, and practical detection engineering.
Popular Reads
These are currently the most visited posts on the site.
Migrating Microsoft Sentinel to Defender XDR: What to Expect
A practical breakdown of the Microsoft Sentinel to Defender XDR migration, including architecture impact, correlation behavior, and planning considerations.
Defender XDR Custom Detection Rules via Graph API
Create and manage Defender XDR custom detection rules through Microsoft Graph API with payload patterns, limits, and caveats.
PowerShell Module for Defender XDR Custom Detection Rules
Manage Defender XDR custom detection rules through Microsoft Graph with entity mappings, automated actions, and service principal authentication.
Latest Posts
The three most recent posts from the site.
Required claims for GitHub flexible federated identity credentials
Microsoft Entra requires GitHub expressions to match sub and compare repository_id or repository_owner_id with eq.
I want you to steal my job ... again
An attempt at distilling why and how to learn from someone who's adept at not knowing stuff
Configuring Sentinel Protected Tables with az rest
How to set protectionLevel on Azure Monitor Logs tables, grant read access, close the control-plane bypass with DataActionsOnly, and audit changes.
Curated Topic Clusters
Start here if you want a focused reading path by topic.
Sentinel Cost and Data Strategy
Cost control, retention choices, and data-tier planning for real-world Sentinel operations.
Detection Engineering and XDR Operations
Detection design, custom rule operations, and Defender XDR execution patterns.
MISP and Threat Intelligence Pipelines
Threat intel ingestion, pipeline hardening, and MISP-to-Sentinel implementation patterns.
All Posts
Everything on the blog, with tag filtering if you want to narrow it down.