AMA vs MMA Agent in Microsoft Sentinel: Complete 2026 Migration Guide
Everything you need to migrate from the deprecated MMA agent to AMA safely — DCR architecture design, parallel deployment, validation queries, and common issues.
-
-
CVE-2026-20820: Windows CLFS Heap Overflow — Privilege Escalation to SYSTEM via Kernel Driver Abuse
April 2026 Patch Tuesday discloses CVE-2026-20820 — a heap-based buffer overflow in Windows CLFS driver enabling local privilege escalation to SYSTEM. CVSS 7.8. Patch immediately: CLFS has a documented history as a ransomware kill chain component.
-
Microsoft Copilot for Security: What Actually Works in a Real SOC (Prompts, Metrics, and Honest Failures)
Skip the vendor demos. Here’s what Microsoft Copilot for Security actually does in day-to-day SOC operations—with specific prompts that produce reliable output, time metrics from real workflows, the failure modes nobody talks about, and an honest verdict by alert category.
-
#SOC | Azure Sentinel | Blogging | Cyber Security | Data management | incident management | Microsoft | Microsoft security
Detection Engineering in Microsoft Sentinel (2026): Why Most SOCs Get It Wrong
Many SOC teams struggle with alert overload and high false positives, not due to insufficient tools like Microsoft Sentinel, but because of poor detection strategies. Effective detection engineering focuses on enabling suitable rules for specific environments and emphasizes understanding log data, deploying detections strategically, and regularly reviewing their effectiveness to improve overall trust in alerts.
-
azure | Azure Sentinel | Blogging | Cyber Security | Data management | incident management | Microsoft | Microsoft security
Microsoft Sentinel Cost Engineering (2026)
This guide presents a framework to optimize Microsoft Sentinel costs while maintaining security. Key cost drivers include unclassified log ingestion and inefficient KQL execution. By classifying logs, implementing Data Collection Rules, and separating retention tiers, organizations can minimize expenses and ensure compliance without compromising detection capabilities.
-
Automation | azure | Azure Sentinel | Cyber Security | Data management | incident management | Microsoft | Microsoft security
Microsoft Sentinel Storage Explained: Analytics Tier vs Data Lake vs Data Archive
Microsoft Sentinel offers three storage options: Analytics Tier, Sentinel Data Lake, and Data Archive, each serving distinct purposes. Proper storage tiering is crucial to avoid high costs and inefficiencies. Understanding each tier’s intended use—detection, investigation, or compliance—is vital for effective security operations and maintaining a scalable system.
-
Microsoft Sentinel (2026) — Technical Deep Dive into Architecture, Data Lake, Analytics & Cost Engineering
A comprehensive 2026 technical deep dive into Microsoft Sentinel’s evolution as a unified security data platform, covering architecture, Sentinel Data Lake design, DCR-based ingestion, normalization with ASIM, Defender integration, SOAR automation, and cost engineering strategies with practical KQL examples.
-
Automation | azure | Azure Sentinel | Blogging | Cyber Security | Microsoft | Microsoft security | powershell
Automate Data Collection Rule and Virtual Machine Association Using PowerShell in Microsoft Sentinel
Effortlessly streamline your Microsoft Sentinel integration with this comprehensive guide. Learn how to automate data collection rule (DCR) association and Azure Monitor Agent (AMA) installation for virtual machines (VMs) using a single PowerShell script. Introduction Integrating VMs with Microsoft Sentinel is essential for robust security monitoring. However, manually managing Azure Monitor Agent installation and Data…
-
azure | Azure Sentinel | Cyber Security | Data management | incident management | Microsoft | Microsoft security
Mastering Sentinel: The Essential KQL Query for Every SOC Team
🚨 Just published a new blog post on mastering KQL in Microsoft Sentinel! 🚨
In this post, I dive into a must-have query that provides detailed insights into your SOC operations, including total incidents, new, active, and closed incidents, as well as incident duration. Whether you’re looking to optimize your incident response or improve reporting, this query is a game-changer for every SOC team.
-
Automation | azure | Azure Sentinel | Cyber Security | incident management | Microsoft | Microsoft security
Troubleshoot Log Ingestion Drops to Microsoft Sentinel from Linux Machines: Addressing /var/log Capacity Issues
In this blog, we’ll address a common issue causing drops in log ingestion from Linux machines to Microsoft Sentinel: the /var/log directory filling up. Learn how to automate log maintenance with cron jobs to keep your logs flowing smoothly and ensure uninterrupted monitoring and analysis with Microsoft Sentinel.
