Microsoft Sentinel - Hybrid Brothers

Subscribe

Microsoft Sentinel

A collection of 11 posts

Correlating Defender for Endpoint and Global Secure Access Logs

Microsoft Sentinel

Correlating Defender for Endpoint and Global Secure Access Logs

Introduction If you are working with Microsoft security solutions, you might have heard of the new kid on the block called Microsoft Global Secure Access. Being a blue teamer myself, I asked myself how we can use this new Secure Service Edge solution - and specifically the Internet Access logs

Parsing CEF messages without Azure Monitor Agent

Microsoft Sentinel

Parsing CEF messages without Azure Monitor Agent

Introduction During my time as SOC Engineer, I do a lot of third-party data source ingestion projects for clients into their Microsoft Sentinel instances. Most of these data sources are network security solutions like firewalls and proxy solutions. When you want to ingest this data into Microsoft Sentinel, you have

Device isolation and containment strategies

Microsoft Sentinel Featured

Device isolation and containment strategies

Introduction As a Security Operation Center, you want to be able to contain devices and users on a network as a response to an adversary event. However, depending on the security stack you are using, containing a device can be done using multiple ways. Each way of performing a containment

Analyzing MDE Network Inspections

Microsoft Sentinel Featured

Analyzing MDE Network Inspections

Microsoft Defender for Endpoint and Network Monitoring In November 2022, Microsoft announced they integrated the Zeek open-source network traffic analyzer in Microsoft Defender for Endpoint. This analyzer helps Defender for Endpoint in analyzing suspicious network traffic and detect network related attacks. In April 2023 they extended the support with Zeek

Defender for Identity NNR and health monitoring

Microsoft Sentinel

Defender for Identity NNR and health monitoring

Introduction Defender for Identity is a very important sensor to detect threats in an Active Directory environment. Therefore, it is important to make sure the sensors are performing well, and no health issues are being reported. When a sensor is in an unhealthy state, detections can be missed, or False

Get control over corporate networks with device discovery

Microsoft Sentinel

Get control over corporate networks with device discovery

Introduction During the last few years, I worked with a couple of customers who struggle with getting control over their corporate networks. Even though we all know corporate networks should be managed well with all the correct security controls like segmentation, Network Access Control implementations, and zero-trust designs, a lot

AitM detection with Sentinel via custom CSS

Microsoft Sentinel

AitM detection with Sentinel via custom CSS

Introduction You are probably wondering, what has CSS to do with detecting AitM sites. In this blog post, we will go over how we can use a custom CSS template in Microsoft Entra ID Company Branding, to trigger a logic that detects when a user visited a Microsoft login page

Demystifying Data Collection Rules and Transformations

Microsoft Sentinel

Demystifying Data Collection Rules and Transformations

Introduction Data Collection Rules in Azure can be very confusing once you really start using all of their potential. During my experience using them in complex setups, I identified a couple of pitfalls I would like to tackle for you. These pitfalls include the complex structures and types of DCRs,

Mapping MDE and Windows Security Events overlap

Microsoft Sentinel

Mapping MDE and Windows Security Events overlap

Introduction In my last blog post, I talked about using MITRE ATT&CK to support Microsoft Sentinel use cases. Today, I will be showing you how we can compare data coverage of data sources in Sentinel with MITRE ATT&CK and OSSEM. In this post you will find

Deploy sentinel analytic rules with bicep and PowerShell

Microsoft Sentinel

Deploy sentinel analytic rules with bicep and PowerShell

Introduction Managing a Microsoft Sentinel environment can get very complex, especially when you are responsible for managing multiple environments as MSSPs do. This is why Infrastructure as Code becomes very important. It makes sure that your environments are consistent, easy to roll out, and modular since you can standardize certain

Operationalizing MITRE ATT&CK to support Microsoft Sentinel deployments and detections

Microsoft Sentinel

Operationalizing MITRE ATT&CK to support Microsoft Sentinel deployments and detections

Introduction Managing a SIEM can be a challenging task to do. When you insert too many log sources in your SIEM without enough filtering and finetuning, your SIEM can get very noisy in no time. An in-depth post about how to manage a SIEM will be available on this site