Microsoft Sentinel

azure | Azure Sentinel | Cyber Security | Data management | incident management | Microsoft security

Log Source Availability Monitoring with KQL in Microsoft Sentinel: An Essential Query for SOC Teams
BySujit Mahakhud September 16, 2024April 11, 2026
In a Security Operations Center (SOC), timely and accurate data is crucial for identifying and responding to threats. Delays in receiving security logs can lead to gaps in monitoring and create blind spots that adversaries may exploit. Ensuring that logs are being ingested at the expected frequency is critical for maintaining a proactive defense posture….
Share this:
X
Facebook
LinkedIn
Telegram
Threads
WhatsApp
Mastodon
More
X
Like this:
Like Loading…
Read More Log Source Availability Monitoring with KQL in Microsoft Sentinel: An Essential Query for SOC Teams
Automation | azure | Azure Sentinel | Cyber Security | incident management | Microsoft security

Suppressing Defender for XDR Incidents Using Automation Rules in Microsoft Sentinel: A Step-by-Step Guide
BySujit Mahakhud August 27, 2024April 11, 2026
In today’s cybersecurity landscape, managing a high volume of security alerts can be overwhelming for security operations teams. This is especially true for organizations using Microsoft Defender for XDR (Extended Detection and Response) integrated with Microsoft Sentinel. While these tools provide robust threat detection and response capabilities, the sheer number of incidents generated can lead…
Share this:
X
Facebook
LinkedIn
Telegram
Threads
WhatsApp
Mastodon
More
X
Like this:
Like Loading…
Read More Suppressing Defender for XDR Incidents Using Automation Rules in Microsoft Sentinel: A Step-by-Step Guide
azure | Azure Sentinel | Cyber Security | Data management | incident management | Microsoft | Microsoft security

Mastering Sentinel: The Essential KQL Query for Every SOC Team
BySujit Mahakhud August 18, 2024April 11, 2026
🚨 Just published a new blog post on mastering KQL in Microsoft Sentinel! 🚨

In this post, I dive into a must-have query that provides detailed insights into your SOC operations, including total incidents, new, active, and closed incidents, as well as incident duration. Whether you’re looking to optimize your incident response or improve reporting, this query is a game-changer for every SOC team.
Share this:
X
Facebook
LinkedIn
Telegram
Threads
WhatsApp
Mastodon
More
X
Like this:
Like Loading…
Read More Mastering Sentinel: The Essential KQL Query for Every SOC Team
Automation | azure | Azure Sentinel | Cyber Security | incident management | Microsoft | Microsoft security

Troubleshoot Log Ingestion Drops to Microsoft Sentinel from Linux Machines: Addressing /var/log Capacity Issues
BySujit Mahakhud June 6, 2024April 11, 2026
In this blog, we’ll address a common issue causing drops in log ingestion from Linux machines to Microsoft Sentinel: the /var/log directory filling up. Learn how to automate log maintenance with cron jobs to keep your logs flowing smoothly and ensure uninterrupted monitoring and analysis with Microsoft Sentinel.
Share this:
X
Facebook
LinkedIn
Telegram
Threads
WhatsApp
Mastodon
More
X
Like this:
Like Loading…
Read More Troubleshoot Log Ingestion Drops to Microsoft Sentinel from Linux Machines: Addressing /var/log Capacity Issues
Cyber Security | incident management

Why Incident Counts Differ in Microsoft Sentinel: Portal vs. SecurityIncident Table
BySujit Mahakhud May 24, 2024April 11, 2026
Ever noticed a difference between incident counts in the Microsoft Sentinel Incident portal and the SecurityIncident table? This blog explains why the SecurityIncident table shows higher counts due to ungrouped alerts, while the Incident portal consolidates them. Understanding the query behind this helps you better interpret your security data.
Share this:
X
Facebook
LinkedIn
Telegram
Threads
WhatsApp
Mastodon
More
X
Like this:
Like Loading…
Read More Why Incident Counts Differ in Microsoft Sentinel: Portal vs. SecurityIncident Table
Automation | Cyber Security | incident management | powershell

Streamlining Bulk Incident Closure in Azure Sentinel with PowerShell
BySujit Mahakhud May 2, 2024April 11, 2026
Automate Azure Sentinel incident closure with PowerShell. Effortlessly close multiple incidents at once, saving time for critical security tasks.
Share this:
X
Facebook
LinkedIn
Telegram
Threads
WhatsApp
Mastodon
More
X
Like this:
Like Loading…
Read More Streamlining Bulk Incident Closure in Azure Sentinel with PowerShell
Cyber Security

Analyzing Authentication Methods in Azure: Insights from Azure Active Directory Audit Logs
BySujit Mahakhud April 25, 2024April 11, 2026
Explore a potent KQL query dissecting Azure AD audit logs. Analyse user authentication methods & mobile numbers for a fortified security posture.
Share this:
X
Facebook
LinkedIn
Telegram
Threads
WhatsApp
Mastodon
More
X
Like this:
Like Loading…
Read More Analyzing Authentication Methods in Azure: Insights from Azure Active Directory Audit Logs
Automation | Azure logic apps | Cyber Security

Automating Email Notifications for Azure KQL Rule using Azure Logic Apps
BySujit Mahakhud March 31, 2024April 11, 2026
In today’s digital landscape, maintaining Azure environment security is vital. Use Azure Logic Apps to automate email notifications for KQL rule triggers. Steps include creating a Logic App, designing the workflow, setting up recurrence, querying Azure Monitor Logs, formatting data, and sending email notifications via Office 365 Outlook. Stay informed and proactive.
Share this:
X
Facebook
LinkedIn
Telegram
Threads
WhatsApp
Mastodon
More
X
Like this:
Like Loading…
Read More Automating Email Notifications for Azure KQL Rule using Azure Logic Apps
Cyber Security

KQL Query to Detect Log Ingestion Downtime by data connector/tables in Microsoft Sentinel
BySujit Mahakhud March 15, 2024April 11, 2026
The blog post emphasizes the crucial need for timely detection of log ingestion issues in a cybersecurity environment. It introduces a Key Query Language (KQL) query designed for Microsoft Sentinel to monitor and ensure prompt log ingestion from essential sources. The query’s value proposition includes timely detection of delays, comprehensive monitoring, and customizability. It also highlights the visualization of log ingestion status through workbooks to provide a clear and intuitive monitoring method. Overall, the KQL query offers a solid foundation for enhancing cybersecurity defenses by proactively managing security operations.
Share this:
X
Facebook
LinkedIn
Telegram
Threads
WhatsApp
Mastodon
More
X
Like this:
Like Loading…
Read More KQL Query to Detect Log Ingestion Downtime by data connector/tables in Microsoft Sentinel
Cyber Security | Data export | Data management

Configure to export data from Azure sentinel to Azure storage account
BySujit Mahakhud March 4, 2024April 11, 2026
This article explains how to export data from a Log Analytics workspace to an Azure Storage Account or Azure Event Hubs. It details the role of Log Analytics workspace in Azure Sentinel, the benefits of exporting data to Azure Storage, and steps to configure the export. By following the provided steps, users can efficiently set up their workspace to transmit historical log data from Azure Sentinel to Azure Storage for storage and analysis.
Share this:
X
Facebook
LinkedIn
Telegram
Threads
WhatsApp
Mastodon
More
X
Like this:
Like Loading…
Read More Configure to export data from Azure sentinel to Azure storage account