**Privileged Identity Management** is one of the best security features in **Entra ID P2** (formerly Azure AD Premium P2). It enforces just-in-time admin access, reduces standing privileges, and gives you an audit trail of who activated what role and when. On paper, it's perfect.

If you've looked at **Microsoft's MITRE ATT&CK coverage dashboards** in Defender XDR or Sentinel, you've probably seen a lot of green. Microsoft will tell you they cover hundreds of techniques across the kill chain, and technically, that's true. But here's the uncomfortable reali

**Microsoft Defender for Identity** is one of the most powerful tools for detecting on-premises Active Directory attacks — but out of the box, it's also one of the noisiest. If you've deployed MDI sensors and found yourself drowning in alerts about suspicious LDAP queries, encryp

**User and Entity Behavior Analytics (UEBA)** in **Microsoft Sentinel** provides machine learning-driven anomaly detection that goes beyond signature-based alerts. In this post, I'll walk through enabling and configuring UEBA to detect insider threats, compromised accounts, and l

Deploying **Microsoft Defender for Endpoint** on Linux servers is a solid first step, but the real security value comes from proper hardening. In this post, I'll walk through practical configurations that go beyond the default deployment to reduce your attack surface and improve

Managing security compliance across Azure environments manually doesn't scale. I've seen too many organisations rely on periodic audits and spreadsheets to track security configurations, only to discover drift during incidents or compliance reviews. Azure Policy provides the auto

In **Part 1**, we covered what **OCSF** is and why it solves critical problems for **Microsoft Sentinel** deployments. This post walks through the technical implementation: creating custom tables for OCSF event classes, configuring **Data Collection Rules (DCR)** to transform log

The **Open Cybersecurity Schema Framework (OCSF)** addresses one of the most persistent challenges in security operations: inconsistent log formats across vendors. If you've spent hours writing custom parsers for every new data source in **Microsoft Sentinel**, OCSF offers a stan

Deploy MISP in an Azure Container Instances (ACI) and Integrate with Microsoft Sentinel

Enabling Defender for Cloud - Initial Setup and Config

Deploying Microsoft Defender for Endpoint to Your First Machine

OpenCTI is an open‑source cyber threat intelligence platform designed to manage and visualise knowledge about cyber threats. This post...

I decided to begin by writing a series of blog posts, starting with "How to Build a Security Operations Centre (SOC)." It has been a...

Hey all, I've been unable to write anything in a while as I've moved from little New Zealand to Australia. I havent been able to post...

Introduction With the rapid advancement of AI products, Microsoft Security Copilot is changing the game in cybersecurity. Harnessing the...

Earlier this week Microsoft announced the new Exposure Management capability within Microsoft Defender. This new tool will enable...

I thought id write something up for anyone wanting to setup Microsoft Sentinel for the first time, but are unsure how. Below are the...

Something I thought id share with the wider community as more then likely most people wont be aware of this, or will have a different...

I thought I'd write some tips, tricks, and notes on how to build out an effective parser for your Sentinel Workspace. There are a heap of...

I thought I would share some details of how to get into the Microsoft Private Preview Community, for the sake of sharing new ideas,...