1122334455

Dad, Diver, Photographer, Punk rocker, and off shore chief infosec person. Opinions are my own.

[1122334455 @ecmanfra]

@HackingLZ Still own a Typhoon and used to own a Syclone, lovely little trucks 😎

[1122334455 @ecmanfra]

@janbakker_ @rucam365 AuditLogs
| where AADOperationType == "ActivateRole"
| extend Account = tostring(InitiatedBy.["user"].["userPrincipalName"])
| distinct TimeGenerated, Account, ResultReason

[1122334455 @ecmanfra]

@HackingLZ @wvuuuuuuuuuuuuu PPSSSSSSTTTT PSSSSTTTTT, Snail > on-land scuba goggles.

[1122334455 @ecmanfra]

@chrislehratx would be REALLY interesting to track providers and breaches, an actual metric on effectiveness of vendor solutions. Of course this isn't the cause of the incident, but it certainly has a small percentage of responsibility.

Won't get you invited to any parties at conferences!

[1122334455 @ecmanfra]

@dcuthbert Atlantic and pacific for sure.. Maybe antarctic and artic (because watch faces), dig the nudibranches too, well done.

[1122334455 @ecmanfra]

@jimbobbennett Best of luck with your next move, you'll do great things!

[1122334455 @ecmanfra]

@Lamp_Sec @defcon Need more details! Gif conversion? Transfer to device? Schematic? Code? Pretty please.

[1122334455 @ecmanfra]

@merill Rebranding core critical services that no one was confused about, creates confusion. Microsoft gonna Microsoft.. 😆

[1122334455 @ecmanfra]

@gabsmashh Don't worry about us, all good over here.

[1122334455 @ecmanfra]

@FrankMcG checked and I don't think i'm on it, appreciate you doing this 😎

[1122334455 @ecmanfra]

@merill Big fan, better than the xlsx from docs.. would make for an interesting Graphical UI vs what is there now. 😎

[1122334455 @ecmanfra]

@NathanMcNulty The docs are good at explaining each setting: https://t.co/1CjGA1qJBQ

[1122334455 @ecmanfra]

@JeffreyAppel7 environments with sccm, intune, and mde enabled and managing end points. how each of these management points can conflict and cause pain.

[1122334455 @ecmanfra]

@HackingLZ quality diy.. good catch, more work but done right, have to be safe to go fast.

[1122334455 @ecmanfra]

@RailwayQueen There is one for NYC as well: https://t.co/TEGGeGXpTV

[1122334455 @ecmanfra]

@reprise_99 Any advice on a good config for local only logging? Need to keep Sysmon data out of Sentinel, avoid the massive increase in spend.

[1122334455 @ecmanfra]

@paulsanders87 @rucam365 Very reasonable for web filtering

[1122334455 @ecmanfra]

@eastdakota @Cloudflare "pieces of flare" or jazzhands

[1122334455 @ecmanfra]

@NathanMcNulty

[1122334455 @ecmanfra]

@hakluke petty and vindictive cio