Jan

big feet and infosec ftw

[Jan @Jan10com]

@BertJanCyber Great post! But how do you know if your detection is running if you are not monitoring the last run status? Any thoughts on that?

[Jan @Jan10com]

Sentinel analytics rules have _SentinelHealth() for failure monitoring. Defender XDR custom detections have... nothing. No table, no native alerting. Just the GUI. How is everyone catching these silent detection failures? @msftsecurity #MicrosoftDefender

[Jan @Jan10com]

Yo, fam! Why’s Action Center history not popping up in my Advanced Hunting tables? Spill the tea, #MicrosoftDefender!

[Jan @Jan10com]

@ellishlomo Why is this posted in LinkedIn though? Shouldn't this be in the Sentinel blog or learn something something Sentinel?

[Jan @Jan10com]

@reprise_99 Find the first and last timestamp

| summarize min(timestamp), max(timestamp)

[Jan @Jan10com]

In #MicrosoftSentinel how can you see if an incident / alert has been suppressed in #DefenderXDR ?

[Jan @Jan10com]

In #MicrosoftDefender how do you see when an incident was created? 🤔

[Jan @Jan10com]

@ITguySoCal You might check AuditLogs as well 🫠

[Jan @Jan10com]

@BertJanCyber Why can't they just allow adx() in Analytics rules instead of introducing more complexity and cost? 🤷‍♂️

[Jan @Jan10com]

Sentinel Analytics: Why can't I add UserPrincipalName to Account type directly? UserPrincipalName used by Defender, but Sentinel makes it so difficult. Is splitting the preferred solution? #MicrosoftSentinel https://t.co/OjRUGuNrBi

[Jan @Jan10com]

You can resolve alerts in Defender, but not in Sentinel🤔 #MicrosoftSentinel

[Jan @Jan10com]

@reprise_99 Hi Matt, how do query for phishing emails with QR code inside? 🤠

[Jan @Jan10com]

@rodtrent Quick question. What is a "valid Sentinel entity structure". Any schema around?
Ref https://t.co/CMeT2l94cO