Category: KQL

Section 12 – Mitigate threats using Microsoft Sentinel – Perform data classification and normalization

Harri Jaakkonen
Posted by Harri Jaakkonen Posted on 28/05/2023 0 Comments on Section 12 – Mitigate threats using Microsoft Sentinel – Perform data classification and normalization
Posted in Azure, Azure Firewall, GitHub, KQL, Microsoft Sentinel, SC-200, Study guide

12th section starting with more Sentinel. This time we are classifying Entities, creating custom log in Log Analytics and parsing the content. So let’s do some designs and configurations. Classify and analyze data by using entities You can do the…

Continue Reading Section 12 – Mitigate threats using Microsoft Sentinel – Perform data classification and normalization

Section 6 – Mitigate threats using Microsoft Defender for Cloud – Implement and maintain cloud security posture management and workload protection

Harri Jaakkonen
Posted by Harri Jaakkonen Posted on 02/04/2023 0 Comments on Section 6 – Mitigate threats using Microsoft Defender for Cloud – Implement and maintain cloud security posture management and workload protection
Posted in Azure, Azure AD, Defender, Identity, KQL, SC-200, Security

Then we go to Defender for Cloud and starting with the planning part. Let’s get going! Be sure to check the previous chapters, you will need that information to understand to journey that we are on. Plan and configure Microsoft…

Continue Reading Section 6 – Mitigate threats using Microsoft Defender for Cloud – Implement and maintain cloud security posture management and workload protection

Section 5 – Mitigate threats using Microsoft 365 Defender – Manage extended detection and response (XDR) in Microsoft 365 Defender

Harri Jaakkonen
Posted by Harri Jaakkonen Posted on 26/03/2023 0 Comments on Section 5 – Mitigate threats using Microsoft 365 Defender – Manage extended detection and response (XDR) in Microsoft 365 Defender
Posted in Azure, Defender, Identity, KQL, SC-200, Security, Study guide

Today we will be discovering XDR with Microsoft 365 Defender. It will be an central hub for many different scenarios. Although you will have interfaces inside Azure portal for Sentinel and Defender for Cloud but you can get those signals…

Continue Reading Section 5 – Mitigate threats using Microsoft 365 Defender – Manage extended detection and response (XDR) in Microsoft 365 Defender

Defender for Cloud security alerts

Harri Jaakkonen
Posted by Harri Jaakkonen Posted on 30/09/2022 0 Comments on Defender for Cloud security alerts
Posted in Azure, Defender, Hybrid, Identity, KQL, Security

The scenario You have a Windows server with a public IP-address and RDP (TCP 3389) is exposed to internet. And there is still over 3 million open TCP 3389 ports out there. Stupid right but if you are one of…

Continue Reading Defender for Cloud security alerts

Section 12 – Manage security operations – Configure and manage security monitoring solutions

Harri Jaakkonen
Posted by Harri Jaakkonen Posted on 11/05/2022 0 Comments on Section 12 – Manage security operations – Configure and manage security monitoring solutions
Posted in Azure, Identity, KQL, Microsoft Sentinel, Security

AZ-500 is continuing with the following: Create and customize alert rules by using Azure Monitor Configure diagnostic logging and log retention by using Azure Monitor Monitor security logs by using Azure Monitor Create and customize alert rules in Azure Sentinel…

Continue Reading Section 12 – Manage security operations – Configure and manage security monitoring solutions