Another blog to help expand Security Knowledge
Overview EDIT: If you need to use this information in workbook, take a look at the “Log Sources & Analytics Rules Coverage” workbook. It uses a combination of ARM templates, JSON, and Regex to show which rules are enabled for a selected table. Very cool! Microsoft Sentinel can show you which MITRE tactics and techniques […]
Overview I recently saw a question about how to do a drilldown in a Microsoft Sentinel workbook. While Rod Trent wrote a post called How to Make Your Azure Sentinel Workbooks Even More Interactive with Drilldowns and Downloads – Azure Cloud & AI Domain Blog (azurecloudai.blog) about 2 years ago on this subject, it deals […]
Overview When accessing information using KQL, sometimes you have a column that contains sub-columns that you want to access. There are a couple of different ways to obtain this information and I will show you two ways in this blog post. The first way will be to extract each column individually. While this works and, […]
Overview Back in the first post in this series, I mentioned that you can easily change how far back you can look to get information in your queries. This post will talk about PowerBI parameters that we will use to do this. Create a parameter Parameters are very easy to create. In left hand navigation […]
Overview This blog post will be slightly different than the ones I typically do as it is not technology driven. Rather this one will focus on describing a way of talking about security programs and the team that uses them. Security as a Car I was playing Forza Horizon 5 (very fun driving game) and […]
Overview So far in this series (if 3 posts can be considered a series), we have ingested data into PowerBI and created a basic report. We looked at some of the pitfalls that may happen when creating a table view. In this post, we will look at the tables themselves and how we can expand […]