Amar Shroff

[Matt Swann @MSwannMSFT]

In Office 365 we aggregate DNS server data to form a dataset we call "Dnsflow". Here's how: https://t.co/6usxsLLBTL by @amarshroff

[Amar Shroff @amarshroff]

@MSwannMSFT @carnal0wnage Joining the logs enabled us to significantly improve the signal to noise ratio and lower the thresholds in the detections.

[Amar Shroff @amarshroff]

@MSwannMSFT @carnal0wnage It was lot of work to join the logs, however even without joining we were able to alert on red-team activity.

[Matt Swann @MSwannMSFT]

Here's how we use DNS for intrusion detection in Office 365: https://t.co/KSz0ouCpK5 by @amarshroff