Automation
-
Microsoft Sentinel Baseline Deployment: From Zero to Operational SOC – Summer Bonus!
Microsoft Sentinel is powerful—but it can’t manage itself. Manual operations like onboarding data connectors, validating ingestion, monitoring workspace health, and auditing configuration changes quickly become a burden. This bonus article walks through building automation around your Sentinel foundations, so you can: Keep your workspaces healthy Ensure configuration compliance Alert on critical changes Free SOC engineers…
-
Microsoft Sentinel Baseline Deployment: From Zero to Operational SOC – Part 3 of 3
Sentinel does not fail because it lacks detections. It fails because alerts overwhelm analysts, automation hides context, and governance is treated as an afterthought. In this series-finale post, we establish a production operational baseline: analytics rules, incident handling, automation boundaries, and long-term governance. This is where Sentinel becomes usable—not just enabled. There is no secret…
-
Why Multi-Factor Authentication is Non-Negotiable for Azure Security
You will never out-patch, out-educate, or out-monitor credential theft — but you can neutralize it. Multi-Factor Authentication (MFA) is the single most effective control available to stop account compromise, making it a foundational pillar of Zero Trust and modern cloud security. When MFA is enforced consistently, stolen passwords become largely useless, dramatically reducing the risk…
-
Azure Logic Apps: Automating Workflows for Security and Business Efficiency
Learn how to use Azure Logic Apps with Microsoft Sentinel to automate workflows, enhance security, and streamline business processes. Step-by-step guide with best practices from Microsoft Cloud Security Framework. Automation is no longer optional—it’s essential for modern businesses and security operations. By combining Azure Logic Apps with Microsoft Sentinel, organizations can streamline incident response, strengthen…
-
Querying Logic App Performance with KQL: A Practical Guide
This post explores how to query Logic App performance using Kusto Query Language (KQL), with a focus on measuring workflow run durations. It breaks down telemetry sources based on Logic App type—Consumption vs. Standard—and guides readers through using AzureDiagnostics, Traces, and LogicAppWorkflowRuntime tables. The article includes practical KQL examples for schema discovery, execution tracking, and…
-
Microsoft Defender for Cloud Use Case: Governance Rules in Action
Security at scale isn’t just about visibility—it’s about enforcement. As organizations grow their cloud footprint across multiple subscriptions, management groups, and even cloud providers, maintaining consistent security posture becomes exponentially harder. Enter Governance Rules in Microsoft Defender for Cloud (MDC). These rules allow security teams to define, enforce, and monitor security policies across their environment…
-
Automated Triage in Microsoft Sentinel
In today’s post we will look at some different ways to automate incident triage in Microsoft Sentinel. Organizations face an ever-increasing volume of security threats. Cyberattacks are becoming more sophisticated, and the sheer number of alerts can overwhelm even the most seasoned security teams. Automated triage in Microsoft Sentinel emerges as a crucial solution, empowering…
-
Using Threat Intelligence in Microsoft Sentinel to Enhance Incidents
In this article, we explore real world automation and improvements to Sentinel Incidents. Leveraging Microsoft Sentinel Playbooks you can streamline your SOC security operations and respond to incidents faster and with the information your Analysts need to make decisions. A key component of this process is the integration of Threat Intelligence (TI) to enrich incident…
-
Responding to Incidents with Microsoft Sentinel – Part 5 – Take Action with Automation
In today’s article we will build on previous automation experiences to further develop your Microsoft Sentinel automation powers! Today we will look at remediating incidents and alerts automatically. We will explore auto-remediation using both playbooks and Sentinel Automation rules.
-
Responding to Incidents with Microsoft Sentinel – Part 4 – Automate Research
Today we take a detailed look at building our own Sentinel Playbooks and gathering information on an Incident automatically. Join me as we build automation to update Alerts with detailed IP lookup information as comments. With basic research done automatically, we can save a lot of time!