Category: CloudSecurity
-
Today, I will demonstrate how to conduct an initial investigation if there are security incidents occurring in your MS Hybrid environment. Please ensure that for comprehensive MS Hybrid-Cloud Security, you have the following Microsoft XDR Solutions available: I have simulated various attack actions on my Hybrid Lab Infrastructure. To conduct an incident investigation, you need…
-
This paragraph serves as an introduction to your blog post. Begin by discussing the primary theme or topic that you plan to cover, ensuring it captures the reader’s interest from the very first sentence. Share a brief overview that highlights why this topic is important and how it can provide value. Use this space to…
-
This paragraph serves as an introduction to your blog post. Begin by discussing the primary theme or topic that you plan to cover, ensuring it captures the reader’s interest from the very first sentence. Share a brief overview that highlights why this topic is important and how it can provide value. Use this space to…
-
This paragraph serves as an introduction to your blog post. Begin by discussing the primary theme or topic that you plan to cover, ensuring it captures the reader’s interest from the very first sentence. Share a brief overview that highlights why this topic is important and how it can provide value. Use this space to…
-
In my latest test setup, I focused on capturing and validating Windows Security Event ID 4728, which logs whenever a user is added to a security-enabled global group—a critical action for monitoring privilege escalation. I started by configuring a custom Data Collection Rule (DCR) via Azure Monitor Agent (AMA) to stream only high-value security events…
-
xploring the future of security operations, I recently integrated Azure OpenAI (GPT-4 Mini) into Microsoft Sentinel using a Logic App to enhance incident investigation. For each incident, the system automatically adds a TTP-based initial investigation comment — generated using up to 200 tokens. These insights appear directly in the incident comment section, offering immediate value…