Recent Blog ArticlesNewest TopicsMost LikesTagged:TagDynamic alert details - The force awakens When authoring a new detection, one must keep in mind that the MTTR is highly impacted by the data available in the incident and alerts. Dynamic alert details allow customization of the alert propert...Correlating Microsoft Defender for Cloud alerts in Sentinel Incident load is one of the major pain points of modern SOC. One of the methods used to manage alert fatigue is using grouping. In this blog post we will demonstrate a concept for correlating Micro...Analytic rules - 'Sentinel entities' new entity type Kusto Query Language(KQL) is a powerful tool to explore your data, helping you discover patterns, identify anomalies and outliers, create statistical modeling, and more. That being said, parsing ent...Joint forces - MS Sentinel and the MITRE framework MITRE ATT&CK is a publicly accessible framework and knowledgebase of tactics and techniques that are commonly used by attackers. The MITRE ATT&CK framework is created and maintained by observing real...How to use Microsoft Sentinel Near Real Time detections When you are faced with security threats, time and speed are of the essence. You need to be aware of threats as they materialize so you can analyze and respond quickly to contain them. Sentinel's nea...Detection tuning – “Making the tuning process simple - one step at a time.” Fine-tuning threat detection rules in your SIEM can be a difficult, delicate, and continuous process of balancing between maximizing your threat detection coverage and minimizing false positive rates...Alert enrichment "how to reduce incident triage and investigation times using dynamic alert details” In this blog post we will explore the new “Alert enrichment” in Azure Sentinel Analytics and do a deep dive into the "Alert details" dynamic content ability. Handling ingestion delay in Azure Sentinel scheduled alert rules At Azure Sentinel we take pride in the ability to ingest data from a variety of sources. However, data ingestion time may vary for different data sources under different circumstances. In thi...
