Andrew
-
Reduce Log Analytics Noise with Azure Monitor DCR Transformations
Security logging is only useful when the right data lands in the right place at a cost the organization can sustain. Noisy logs can hide real signals, inflate ingestion, and make analysts distrust the workspace. In this walkthrough, we build a controlled Data Collection Rule transformation, test the KQL logic, validate the resulting records in…
-
Build an Azure Network Security Perimeter Around PaaS Resources
PaaS resources are easy to deploy and easy to expose. Firewalls, private endpoints, and resource-level network rules help, but teams still need a consistent way to define which public inbound and outbound paths are acceptable for supported PaaS services. This walkthrough builds a small Azure Network Security Perimeter pilot, associates supported PaaS resources, defines access…
-
Azure Updates – Number 144 – August 22, 2026
A summary update on Azure news that includes updates released from Microsoft Azure related to Azure, Architecture, Compute, Security Copilot and Sentinel topics. Save time digging around to find recent releases and changes.
-
Enable API Security Posture Management with Defender CSPM
Many organizations know what APIs they intentionally publish through API Management, but they do not always know which APIs appear through function endpoints, Logic Apps, or cloud-native integration paths. API posture management helps close that inventory gap. In this walkthrough, we enable and use Defender CSPM API security posture signals to discover APIs across supported…
-
Thunderstruck in Microsoft Defender XDR
This article builds a controlled Microsoft Defender XDR hunt that correlates process and network telemetry, creates a reusable filtered data set, assigns a transparent risk score, and identifies unusual scripting volume. The AC/DC theme stays light; the technical work does not. Bringing a couple of my own passions for metal & KQL together! Join me…
-
Azure Updates – Number 143 – August 8, 2026
A summary update on Azure news that includes updates released from Microsoft Azure related to Azure, Architecture, Compute, Security Copilot and Sentinel topics. Save time digging around to find recent releases and changes.
-
Saturday Heat – Bonus Walkthrough!
There is too much heat this week for me. I took the opportunity to try & find some distraction for you too! In this Saturday bonus article, we will build several practical security queries progressively. We will begin by reviewing raw Microsoft Entra sign-in data, add filters, summarize the results, extract values from dynamic fields,…
-
Protect Azure API Management APIs with Microsoft Defender for APIs
APIs often expose business logic directly to users, partners, mobile apps, and automation. When an API lacks authentication, exposes sensitive data, or carries unused legacy routes, the risk is not just infrastructure exposure; it is application behavior exposed through a managed gateway.
-
Azure Updates – Number 142 – July 25, 2026
A summary update on Azure news that includes updates released from Microsoft Azure related to Azure, Architecture, Compute, Security Copilot and Sentinel topics. Save time digging around to find recent releases and changes.
-
Azure Updates – Number 141 – July 11, 2026
A summary update on Azure news that includes updates released from Microsoft Azure related to Azure, Architecture, Compute, Security Copilot and Sentinel topics. Save time digging around to find recent releases and changes.