Cyber Security

Automation | azure | Azure Sentinel | Blogging | Cyber Security | Microsoft | Microsoft security | powershell

Automate Data Collection Rule and Virtual Machine Association Using PowerShell in Microsoft Sentinel
BySujit Mahakhud December 6, 2024April 11, 2026
Effortlessly streamline your Microsoft Sentinel integration with this comprehensive guide. Learn how to automate data collection rule (DCR) association and Azure Monitor Agent (AMA) installation for virtual machines (VMs) using a single PowerShell script. Introduction Integrating VMs with Microsoft Sentinel is essential for robust security monitoring. However, manually managing Azure Monitor Agent installation and Data…
Share this:
X
Facebook
LinkedIn
Telegram
Threads
WhatsApp
Mastodon
More
X
Like this:
Like Loading...
Read More Automate Data Collection Rule and Virtual Machine Association Using PowerShell in Microsoft Sentinel
azure | Azure Sentinel | Cyber Security | Data management | incident management | Microsoft security

Log Source Availability Monitoring with KQL in Microsoft Sentinel: An Essential Query for SOC Teams
BySujit Mahakhud September 16, 2024April 11, 2026
In a Security Operations Center (SOC), timely and accurate data is crucial for identifying and responding to threats. Delays in receiving security logs can lead to gaps in monitoring and create blind spots that adversaries may exploit. Ensuring that logs are being ingested at the expected frequency is critical for maintaining a proactive defense posture….
Share this:
X
Facebook
LinkedIn
Telegram
Threads
WhatsApp
Mastodon
More
X
Like this:
Like Loading...
Read More Log Source Availability Monitoring with KQL in Microsoft Sentinel: An Essential Query for SOC Teams
Automation | azure | Azure Sentinel | Cyber Security | incident management | Microsoft security

Suppressing Defender for XDR Incidents Using Automation Rules in Microsoft Sentinel: A Step-by-Step Guide
BySujit Mahakhud August 27, 2024April 11, 2026
In today’s cybersecurity landscape, managing a high volume of security alerts can be overwhelming for security operations teams. This is especially true for organizations using Microsoft Defender for XDR (Extended Detection and Response) integrated with Microsoft Sentinel. While these tools provide robust threat detection and response capabilities, the sheer number of incidents generated can lead…
Share this:
X
Facebook
LinkedIn
Telegram
Threads
WhatsApp
Mastodon
More
X
Like this:
Like Loading...
Read More Suppressing Defender for XDR Incidents Using Automation Rules in Microsoft Sentinel: A Step-by-Step Guide
azure | Azure Sentinel | Cyber Security | Data management | incident management | Microsoft | Microsoft security

Mastering Sentinel: The Essential KQL Query for Every SOC Team
BySujit Mahakhud August 18, 2024April 11, 2026
🚨 Just published a new blog post on mastering KQL in Microsoft Sentinel! 🚨

In this post, I dive into a must-have query that provides detailed insights into your SOC operations, including total incidents, new, active, and closed incidents, as well as incident duration. Whether you’re looking to optimize your incident response or improve reporting, this query is a game-changer for every SOC team.
Share this:
X
Facebook
LinkedIn
Telegram
Threads
WhatsApp
Mastodon
More
X
Like this:
Like Loading...
Read More Mastering Sentinel: The Essential KQL Query for Every SOC Team
Azure Sentinel | Cyber Security | Microsoft security

Troubleshooting SELinux Blocking Connection to the AMA Agent
BySujit Mahakhud August 5, 2024April 11, 2026
Encountering SELinux blocking the AMA connection to Microsoft Sentinel? This blog provides simple steps to troubleshoot and resolve the issue, ensuring smooth CEF and Syslog data forwarding, especially if MMA or OMS agents were previously installed.
Share this:
X
Facebook
LinkedIn
Telegram
Threads
WhatsApp
Mastodon
More
X
Like this:
Like Loading...
Read More Troubleshooting SELinux Blocking Connection to the AMA Agent
Automation | azure | Azure Sentinel | Cyber Security | incident management | Microsoft | Microsoft security

Troubleshoot Log Ingestion Drops to Microsoft Sentinel from Linux Machines: Addressing /var/log Capacity Issues
BySujit Mahakhud June 6, 2024April 11, 2026
In this blog, we’ll address a common issue causing drops in log ingestion from Linux machines to Microsoft Sentinel: the /var/log directory filling up. Learn how to automate log maintenance with cron jobs to keep your logs flowing smoothly and ensure uninterrupted monitoring and analysis with Microsoft Sentinel.
Share this:
X
Facebook
LinkedIn
Telegram
Threads
WhatsApp
Mastodon
More
X
Like this:
Like Loading...
Read More Troubleshoot Log Ingestion Drops to Microsoft Sentinel from Linux Machines: Addressing /var/log Capacity Issues
Cyber Security | incident management

Why Incident Counts Differ in Microsoft Sentinel: Portal vs. SecurityIncident Table
BySujit Mahakhud May 24, 2024April 11, 2026
Ever noticed a difference between incident counts in the Microsoft Sentinel Incident portal and the SecurityIncident table? This blog explains why the SecurityIncident table shows higher counts due to ungrouped alerts, while the Incident portal consolidates them. Understanding the query behind this helps you better interpret your security data.
Share this:
X
Facebook
LinkedIn
Telegram
Threads
WhatsApp
Mastodon
More
X
Like this:
Like Loading...
Read More Why Incident Counts Differ in Microsoft Sentinel: Portal vs. SecurityIncident Table
Automation | Cyber Security | incident management | powershell

Streamlining Bulk Incident Closure in Azure Sentinel with PowerShell
BySujit Mahakhud May 2, 2024April 11, 2026
Automate Azure Sentinel incident closure with PowerShell. Effortlessly close multiple incidents at once, saving time for critical security tasks.
Share this:
X
Facebook
LinkedIn
Telegram
Threads
WhatsApp
Mastodon
More
X
Like this:
Like Loading...
Read More Streamlining Bulk Incident Closure in Azure Sentinel with PowerShell
Cyber Security

Analyzing Authentication Methods in Azure: Insights from Azure Active Directory Audit Logs
BySujit Mahakhud April 25, 2024April 11, 2026
Explore a potent KQL query dissecting Azure AD audit logs. Analyse user authentication methods & mobile numbers for a fortified security posture.
Share this:
X
Facebook
LinkedIn
Telegram
Threads
WhatsApp
Mastodon
More
X
Like this:
Like Loading...
Read More Analyzing Authentication Methods in Azure: Insights from Azure Active Directory Audit Logs
Automation | Azure logic apps | Cyber Security

Automating Email Notifications for Azure KQL Rule using Azure Logic Apps
BySujit Mahakhud March 31, 2024April 11, 2026
In today’s digital landscape, maintaining Azure environment security is vital. Use Azure Logic Apps to automate email notifications for KQL rule triggers. Steps include creating a Logic App, designing the workflow, setting up recurrence, querying Azure Monitor Logs, formatting data, and sending email notifications via Office 365 Outlook. Stay informed and proactive.
Share this:
X
Facebook
LinkedIn
Telegram
Threads
WhatsApp
Mastodon
More
X
Like this:
Like Loading...
Read More Automating Email Notifications for Azure KQL Rule using Azure Logic Apps

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this:

Share this:

Like this: