New and Improved Microsoft Sentinel documentation program

Introduction Wow! Just realized it has been half a year since I have posted anything new. Sorry about that. Well, this one is worth it. A brand-new update to the Export-AzSentinelConfigurationToWord.ps1 program that I wrote a long, long time ago. It uses PowerShell to display a nice GUI so that you can easily enter the […]

Using Microsoft Sentinel Watchlists in a Cross Workspace query

Introduction In my last post, I talked about how to get a single (or a few) entries from a Microsoft Sentinel watchlist. I introduced the fact that watchlists are stored in the “Watchlist” table. We can use this to perform cross workspace queries. _GetWatchlist Again, in my last blog post, I talked about the “_GetWatchlist” […]

How to get a single row from a Microsoft Sentinel watchlist quickly

Introduction 19 Jan 2024 UPDATE: I have posted this same information (not quite as detailed) in the Microsoft Sentinel blog at Querying Watchlists – Microsoft Community Hub however, it does have a section on “bag_unpack” and the best way to use it. As I am sure you already know, you can get the entries from […]

Programming book Version 1.0 finally ready!

I have finally finished the first version of my “Programming Microsoft Sentinel using REST APIs” EBook is ready to go. You can download it from: garybushey/ProgrammingMicrosoftSentinel: Programming Microsoft Sentinel book (github.com) Let me know what you think. Can you easily follow it? Are the examples (both in the descriptions and use cases) useful and easy […]