I am excited to announce the public release of KQL Event Viewer. This is easily the most complete and useful project I have built to date. KQL Event Viewer is a Windows Event Viewer-style experience for KQL data. Instead of starting with a query, you start with the data. Tables are organized, pre-filtered, and easy… Read More »
This week marked the end of an era. I am in the process of transitioning to a new role, and I will share more about that soon. As part of that transition, I delivered what will likely be my final class in this program, a three-day remote cybersecurity session. Keeping an audience engaged for three… Read More »
I have been working with Microsoft Sentinel since before it reached general availability in September 2019, supporting customers, delivering training, and developing real-world deployment guidance. Over that time, I have worked with dozens of organizations across both commercial and government environments, ranging from small universities to large global enterprises. I share that context only to… Read More »
A practical alternative and complement to Security Copilot I wrote about Alternatives to Microsoft Security Copilot last year and why many organizations are still looking for practical ways to bring AI into their SOC. That conversation has continued to come up in customer engagements. Some teams do not have access yet. Others are constrained by… Read More »
In the last article, I introduced Azure AI Foundry as a way to stand up a private AI service for SOC use cases. The key idea is that the model itself is not the solution. The value comes from how you shape requests using system prompts and structured input. One deployment can support many different… Read More »
I keep seeing the same pattern, and it is getting frustrating. Microsoft is calling custom chatbots “agents,” and now everyone is building them. The problem is most of these so-called agents are not agents at all. They are just slightly modified chat prompts wrapped in a UI. I said this before, but it is worth… Read More »
Azure Workbooks are surprisingly capable and frustrating. In many ways, they are far more powerful than they appear at first glance. The UI does not always make it obvious where things live or how features connect, so it takes some effort to learn which buttons to push and in what order. Like many things in… Read More »
I was introduced to the Copilot Earth project late last year, and that got me thinking about how a similar concept could be applied to security. The idea of visualizing activity at a global level, enriched and interactive, felt like something that should exist for a SOC. From there, one idea led to another. I… Read More »
I put together a small project called Global Threat Atlas. It started out simple, and 500+ commits later it turned into something production-ready. It can be deployed today in Azure commercial subscriptions. This is built with an operations center in mind. It works well as a glanceable wallboard, but you can also interact with it… Read More »
My oldest child is a game design major. The program is very anti-AI. That reaction is understandable when you are trying to learn the fundamentals of a craft. Nobody wants shortcuts replacing real skill while they are still trying to master the basics. One thing that surprised me is how many students in the program… Read More »
I write a lot of prompts. Easily dozens a day at this point. Between experimenting with ideas, vied coding , vibe learning, asking questions, and drafting content, a good part of my day involves typing into some kind of LLM prompt. The odd part is that I have never been a great typist, despite thousands… Read More »
I see a growing amount of chatter about “securing AI,” but that phrase is so broad that it almost loses meaning. Securing what exactly? Most of these conversations are really about large language models (LLMs). And even then, the security discussion is very different depending on whether you are talking about public LLMs, enterprise LLMs,… Read More »
Vibe coding is an informal term used to describe a style of development where a large language model writes most of the code interactively. Instead of starting with detailed designs or carefully planned implementations, you describe intent. You explain what you want to build, how it should behave, or what needs to change, and the… Read More »
I recently responded to a customer who had questions about device compliance policies and how they interact with Conditional Access. While researching my response, I was reminded how often Microsoft Intune is overlooked as a security solution, even though it now sits at the center of Microsoft’s cloud security and zero trust strategy. That disconnect… Read More »
AI agents are often marketed as the natural evolution of large language models. The implication is that agents are smarter, more capable, and more useful than a standard chat interface. In reality, many so-called agents fail to add meaningful value and instead introduce friction, duplication, and confusion. To understand why this keeps happening, it helps… Read More »
I have been making my way through a lot of long book series over the last few years, and once you fall into the right one, the books disappear faster than you expect. Joe Ledger is the one I am deep into right now, and that reminded me how many great multi-book runs I have… Read More »
Over the past several months I have written several articles about AI as part of my own learning journey. Each time I dig deeper, I find new ways to explain how these systems work in a way that makes sense to people who are curious but not technical. This article continues that effort by covering… Read More »
Artificial intelligence is often said to be grown, not built. The phrase, often attributed to thinkers in AI safety circles, captures the idea that modern AI systems are not engineered like traditional software. They are cultivated through data and experience, shaped by feedback, and refined through countless iterations until patterns begin to emerge. AI did… Read More »
If someone walked you through what they did to “create an AI,” you might be surprised, or even a little disappointed, by how simple it actually was to bring it to life. AI coding often sounds far more mysterious than it really is. When people hear “AI development,” they tend to imagine complex systems being… Read More »
Traditional SIEMs follow a predictable model: collect logs from many sources, ingest them into a central store, normalize them into a readable schema, index them, and then use queries, dashboards, and alerts to investigate and respond. This design exists because data is scattered, inconsistent, and hard to retrieve. Centralization solves those problems but introduces challenges… Read More »