In **Part 1**, we covered what **OCSF** is and why it solves critical problems for **Microsoft Sentinel** deployments. This post walks through the technical implementation: creating custom tables for OCSF event classes, configuring **Data Collection Rules (DCR)** to transform log

The **Open Cybersecurity Schema Framework (OCSF)** addresses one of the most persistent challenges in security operations: inconsistent log formats across vendors. If you've spent hours writing custom parsers for every new data source in **Microsoft Sentinel**, OCSF offers a stan

I thought I'd write some tips, tricks, and notes on how to build out an effective parser for your Sentinel Workspace. There are a heap of...

I thought I'd create a guide for ingesting multiple tenants' security information from the same platform. For example, if I have multiple...

Intro Hey all, I thought I'd create a new get-started series for newcomers and people wanting to know more about Microsoft Sentinel. In...

A feature that has been wanted for an extremely long time (in my opinion) is finally here. Something that gives alerting a step up when...