kql
Lessons from the field. Always landing on my feet.
All
Cloud Security
Identity Security
Microsoft Sentinel
Microsoft Defender
AI Security
Detection Engineering
Threat Detection
Container Security
Entra ID
Zero Trust
DevSecOps
Infrastructure as Code
Agentic AI
12 posts
Detecting OAuth Redirect Abuse with Microsoft Sentinel and Entra ID
Review update (September 26, 2026): The merged source preserves an already-disabled user-consent policy and refuses unrecognized custom self-consent policy replacement for manual review. Reports, manifest staging and request-body files are …
The February 2026 Microsoft Sentinel Drop: UEBA Essentials, Copilot Connector, and 9 New GA Connectors
Review update (September 25, 2026): The diagram and measured results describe February evidence. For current use, Defender-portal onboarding replaces Fusion incident correlation with the Defender XDR engine. Connector descriptions refer to what is …