Timur Engin

Cybersecurity Research @Microsoft | Incident Response | Tweets are my own opinion |

[Timur Engin @timurengin_]

@utkusen Evet özellikle KOBİ’ler için ideal

[Matt Zorich @reprise_99]

Great article here from @timurengin_ about using Azure Data Explorer (or the Kusto desktop app) to visualize sign in data (or anything else really!) onto an interactive map - https://t.co/GjGsHXGAYM

[Timur Engin @timurengin_]

Kusto serisinin dördüncü yazısı, bu sefer join, union ve distinct komutları anlatılıdı. İyi okumalar...

https://t.co/Ptwdf0eRlW

[Timur Engin @timurengin_]

It's rare to effectively analyse an incident with only on-prem logs, and cloud logging is not at the level it should be. I share some must-have logs in Azure for incident analysis: https://t.co/zikjpWZr0L

[Timur Engin @timurengin_]

@AlanJ_KA7 @reprise_99 I really didn't expect this...

[Timur Engin @timurengin_]

Uzun bir aradan sonra, Kusto serisinin üçüncü yazısı: https://t.co/0421K6wttt

[Timur Engin @timurengin_]

@sunnyc7 @rucam365 @reprise_99 Since December the quality of the queries has gone up quite a bit. Back in December the queries didn't work, now they do.

The queries it does generate aren't the most complex but if you don't know where to start or just want something quick, it's a great tool...

[Timur Engin @timurengin_]

@ItsReallyNick ChatGPT is also getting decent at Kusto. Most of the time you can't use them as-is, but they can act as good starting points...

[Timur Engin @timurengin_]

@BushidoToken New AV Bypass "You Can't See Me"

[Timur Engin @timurengin_]

@SBousseaden @anton_chuvakin Are you assuming no configuration changes to reduce number of FPs, or using tools as is? Answer will be quite different depending on this

[Timur Engin @timurengin_]

Kusto Query Language Türkçe serisinin ikinci yazısı çıktı. Umarım KQL öğrenmek isteyenler için faydalı olur: https://t.co/0YoXtARcfG

[Timur Engin @timurengin_]

Maalesef sysadmin ve güvenlik ekipleri Active Directory'e yeterince önem vermiyor. Bu da saldırganlar için işi kolaylaştırıyor. Bu konuda katkımız olsun diye Mehmetcan TOPAL ile beraber AD atak vektörleri, savunma ve tespit yöntemlerini anlattık https://t.co/T3lQpuys88

[Timur Engin @timurengin_]

@Cyb3rMonk @LucyIsOpal Sentinel has Fusion which can generate some interesting alerting.

[Timur Engin @timurengin_]

@TeriRadichel Same accounts being used for productivity and admin.

[Timur Engin @timurengin_]

@Cyb3rMonk Aggregation/pivot tables, and time series especially when spotting patterns or outliers. I would

[Timur Engin @timurengin_]

Kusto Query Language, Microsoft ve Azure servislerinde (güvenlik, yapay zeka, veri yönetimi, ...) kullanılan sorgu dili. Maalesef Türkçe kaynak yok denecek kadar az. KQL'i anlattığım bir seriye başladım, ilk yazı burada: https://t.co/c921qJNdVE

[Timur Engin @timurengin_]

New blog I wrote on how to understand and take action against malicious Azure AD sign-in attempts: https://t.co/kuMsOCdMaL

[Timur Engin @timurengin_]

New blog post about some Sentinel automation. Much more customisation available with Logic Apps than I wrote about here. You can use Logic Apps to reduce alert fatigue, update dynamic data stores, etc. https://t.co/sb9u6HfHfr

[Timur Engin @timurengin_]

Really useful blog outlining a tool that I helped work on. The tool works as a GUI to call APIs on multiple devices in MDE. It allows for calling APIs based on query output too. Blog by a fantastic colleague of mine: https://t.co/zurTbSlBO3

and the code:
https://t.co/kF8zXxFZgD