Series
A technical series on SOC operations and SIEM engineering, covering SIEM design, threat detection, hunting, automation, containment, and continuous monitoring across Microsoft 365 cloud environments.
Overview. Email remains one of the most vital business communication tools, but it is also the most frequently exploited attack vector. Threats such as phishing, spoofing, impersonation, and Business Email Compromise (BEC) continue to succeed largely...
Security teams need fast, structured, and contextual alerts. This guide shows how to deliver Sentinel incidents to Teams using Logic Apps.
A Field-Tested Collection of KQL Queries for Microsoft Sentinel Analysts to Accelerate Detection, Investigation, and Threat Correlation.
Detecting Modifications to MX, A, and TXT Records Using Azure Logic Apps and DNS-over-HTTPS.
A practical guide to collecting and analysing user authentication method data with Microsoft Graph, Azure Logic Apps, and Microsoft Sentinel.
A deep dive on ClickFix, mapping fake CAPTCHA lures to endpoint code execution, covering investigation, response, and preventative controls.
