The hottest Microsoft Sentinel Substack posts right now

And their main takeaways
Category
Top Technology Topics

Removing Deprecated Analytics Rules in Microsoft Sentinel

Rod’s Blog • 99 implied HN points • 06 Jun 23
🕹 Technology Microsoft Sentinel Threat intelligence
  1. Having outdated Indicators of Compromise (IOCs) in your analytics rules in Microsoft Sentinel can be unproductive and consume resources. Consider cleaning up the deprecated rules to optimize performance.
  2. Check for **[Deprecated]** rules in the Rule Templates section of the Analytics Rules blade in Microsoft Sentinel to identify outdated rules that need removal.
  3. Consider implementing Microsoft's Threat Intelligence solution to enhance threat detection by matching log data with up-to-date IOCs generated by Microsoft.

Microsoft Sentinel SOC 101: How to Detect and Mitigate Social Engineering Attacks with Microsoft Sentinel

Rod’s Blog • 39 implied HN points • 06 Feb 24
🕹 Technology Cybersecurity Microsoft Sentinel Social Engineering Threat Detection
  1. Social engineering attacks can have devastating consequences on organizations, leading to financial loss, reputational harm, and legal issues.
  2. Microsoft Sentinel employs machine learning, behavioral analysis, and threat intelligence to effectively detect and mitigate social engineering attacks.
  3. To defend against social engineering, organizations should implement a comprehensive defense strategy utilizing technical controls, user awareness training, and incident response procedures.

Permissions Required to Migrate to the New Simplified Pricing Model in Microsoft Sentinel

Rod’s Blog • 59 implied HN points • 07 Aug 23
🕹 Technology Security Software Microsoft Sentinel Pricing
  1. To migrate to the new simplified pricing model in Microsoft Sentinel, you need specific permissions like "Microsoft.OperationsManagement/solutions/write" on the "SecurityInsights(<workspace name>)" solution resource.
  2. Support is considering updating documentation or the built-in role for easier migration to the new pricing model.
  3. Stay updated on resolving the permission issue by following the provided links to Microsoft Security Insights show and joining the MSI Show Discord Server.
Get a weekly roundup of the best Substack posts, by hacker news affinity:

How to Get a List of Your Active Analytics Rules for Microsoft Sentinel

Rod’s Blog • 19 implied HN points • 12 Jan 23
🕹 Technology Data Analytics Microsoft Sentinel API
  1. To get a list of active Analytics Rules in Microsoft Sentinel, use the Workspace Usage Report Workbook's Active Rules via Rest API module to download a CSV file of the results.
  2. You can also access a list of Analytics Rule templates by utilizing the Rule Templates via Rest API module.
  3. Consider exploring Twitter, LinkedIn, or subscribing to newsletters for further engagement with the topic.

The Revoke Action for Threat Indicators in Microsoft Sentinel

Rod’s Blog • 0 implied HN points • 12 Jan 23
🕹 Technology Security Microsoft Sentinel Threat intelligence
  1. Marking a threat indicator as 'Revoked' in Microsoft Sentinel sets a flag indicating the indicator is no longer active, excluding it from rules.
  2. By marking an indicator as 'Revoked' instead of deleting it, you can keep it excluded from rules while still being able to query against it.
  3. This feature is particularly useful for managing potential false positives from 3rd party sources in Microsoft Sentinel's Threat Intelligence blade.