Hunting Impossible Travel in Sentinel with KQL
Two sign-ins too far apart in time and distance to be one person. In Sentinel, KQL's prev() and a distance function are all it takes.
Cybersecurity
Break-Glass Accounts: The Ones You Hope You Never Use, Done Properly
Entra break-glass (emergency access) accounts: cloud-only, excluded from every policy, watched closely, and tested before you need them.
Hunting Password Spray in Sentinel: One Password Against a Thousand Doors
Brute force tries many passwords on one account. Spray tries one password on many accounts, and hides under your lockout threshold. Here's the shape it leaves.
Hunting MFA Fatigue in Sentinel: Building the Detection One Line at a Time
Push-bombing leaves a loud shape in SigninLogs. In Sentinel, a KQL count, a threshold and a join are enough to catch it.
How Many SCUs Does Security Copilot Actually Need? Sizing Capacity Without the Bill Shock
How many SCUs Security Copilot needs: provisioned versus overage, hourly billing, the E5 allocation per 1,000 licences, and avoiding capacity cliffs.
Setting Up Microsoft Security Copilot: Capacity, Roles, and the Defaults That Bite
How to set up Microsoft Security Copilot: E5 auto-provisioning, prerequisites for provisioning capacity, SCUs, and the default roles to fix on day one.
Conditional Access: Getting It Right Without Locking Yourself Out
Break-glass first, report-only always, and the other habits that keep a Conditional Access rollout from ending in a lockout.
Getting Started with Sentinel Hunting: A KQL Primer for People Who Keep Putting It Off
A KQL primer for hunting in Microsoft Sentinel: five operators, one mental model, and why you never trust a detection you can't read.
Hybrid Cloud Security: The Gaps Nobody Talks About Until It's Too Late
The identity seam, stale permissions, logging gaps and shared-responsibility confusion that hybrid environments accumulate.