Hunting MFA Fatigue in Sentinel: Building the Detection One Line at a Time
Push-bombing leaves a loud shape in SigninLogs. A count, a threshold and a join are enough to catch it.
KQL Hunting
Getting Started with Sentinel Hunting: A KQL Primer for People Who Keep Putting It Off
Five operators, one mental model, and the discipline of never trusting a detection you can't read.