microsoft-sentinel
Lessons from the field. Always landing on my feet.
AKS Runtime Security: Binary Drift, Anti-Malware & Gated Deployment with Defender for Cloud
Review update (September 25, 2026): The merged September 25 source resolves and records an exact regional GA Kubernetes patch on first deployment and refuses implicit version changes on owned reruns. Pricing restoration is bound to the captured …
Detecting OAuth Redirect Abuse with Microsoft Sentinel and Entra ID
Review update (September 26, 2026): The merged source preserves an already-disabled user-consent policy and refuses unrecognized custom self-consent policy replacement for manual review. Reports, manifest staging and request-body files are …
The February 2026 Microsoft Sentinel Drop: UEBA Essentials, Copilot Connector, and 9 New GA Connectors
Review update (September 25, 2026): The diagram and measured results describe February evidence. For current use, Defender-portal onboarding replaces Fusion incident correlation with the Defender XDR engine. Connector descriptions refer to what is …
Sentinel MCP Server: Securing Your SOC's New AI Attack Surface
Review update (September 25, 2026): The walkthrough captures show January 6, 2026 evidence and an earlier tool inventory. The related detection lab is a source-reviewed identity/activity lab; it does not by itself prove ingestion or coverage of …