Mar 28, 2021
Monitoring the publication of new Azure Sentinel alert rule templates
Anyone familiar with Azure Sentinel knows that one can open the portal one day and find 20 new additional data connectors and 50 new alert rule templates along with additional goodies such as hunting queries, parsers, workbooks and sometimes whole new major add-ons such as UEBA. Unless one meticulously checks the rules on regular basis […]
Read More Mar 15, 2021
Log Ingestion Lag in Cloud-Based SIEMs
Lag in log ingestion is a topic that comes up now and then in our Azure Sentinel design discussions with our customers. We even had concerns around the speed of light being a constrain for certain critical log sources. These would be valid for security controls designed to protect strategic infrastructure but one has to […]
Read More Feb 20, 2021
Using KQL to Ingest External Data In Azure Sentinel
One of the most sought-after features of a modern SIEM is the ability to read data from various Internet-based sources and use it to enrich the analysis of the raw logs. Such resources could come in various “packages” – they could be freely downloadable files or they may require authentication tokens/paid subscriptions, some are CSV, […]
Read More Feb 8, 2021
Azure Security Center Design
This post is a second iteration on Azure Security Center (ASC), part of our effort to provide one-page diagrams for Microsoft’s M365/Defender (aka XDR) components. In our first post on ASC, we mentioned how one of the most common questions that we are receiving about Azure Sentinel is about its functionality compared with Azure Security […]
Read More Feb 2, 2021
Microsoft Security Products vs. Other Cloud Security Products
In recent years, Microsoft has emerged as a market leader for a wide range of security areas, with a high focus on the hybrid infrastructure. In the diagram below, we are attempting to map each of the Microsoft security products to products to other vendors that have a significant market presence. Some of them are […]
Read More 
