Hunting MFA Fatigue in Sentinel: Building the Detection One Line at a Time
Push-bombing leaves a loud shape in SigninLogs. A count, a threshold and a join are enough to catch it.
Most security problems aren't exotic
They're the seams nobody owns, the permissions nobody removed, and the detections nobody can read. I write about fixing that: practical, principle-based, from a decade-plus in security engineering, hybrid cloud and large-scale infrastructure.
How Many SCUs Does Security Copilot Actually Need? Sizing Capacity Without the Bill Shock
Provisioned versus overage, the hourly billing quirk, the E5 allocation, and what running out looks like mid-incident.
Setting Up Microsoft Security Copilot: Capacity, Roles, and the Defaults That Bite
Enablement, SCUs, and the everyone-is-a-Contributor default you want to fix on day one.
Conditional Access: Getting It Right Without Locking Yourself Out
Break-glass first, report-only always, and the other habits that keep a CA rollout from ending in a lockout.
Getting Started with Sentinel Hunting: A KQL Primer for People Who Keep Putting It Off
Five operators, one mental model, and the discipline of never trusting a detection you can't read.