Hunting MFA Fatigue in Sentinel: Building the Detection One Line at a Time
Push-bombing leaves a loud shape in SigninLogs. A count, a threshold and a join are enough to catch it.
Posts
How Many SCUs Does Security Copilot Actually Need? Sizing Capacity Without the Bill Shock
Provisioned versus overage, the hourly billing quirk, the E5 allocation, and what running out looks like mid-incident.
Setting Up Microsoft Security Copilot: Capacity, Roles, and the Defaults That Bite
Enablement, SCUs, and the everyone-is-a-Contributor default you want to fix on day one.
Conditional Access: Getting It Right Without Locking Yourself Out
Break-glass first, report-only always, and the other habits that keep a CA rollout from ending in a lockout.
Getting Started with Sentinel Hunting: A KQL Primer for People Who Keep Putting It Off
Five operators, one mental model, and the discipline of never trusting a detection you can't read.
Hybrid Cloud Security: The Gaps Nobody Talks About Until It's Too Late
The identity seam, stale permissions, logging gaps and shared-responsibility confusion that hybrid environments accumulate.