Traditional SIEMs follow a predictable model: collect logs from many sources, ingest them into a central store, normalize them into a readable schema, index them, and then use queries, dashboards, and alerts to investigate and respond. This design exists because data is scattered, inconsistent, and hard to retrieve. Centralization solves those problems but introduces challenges… Read More: Could AI Replace the SIEM? »
During a recent Security Copilot demo, a customer asked an excellent question: “Can these agents run PowerShell?” The short answer is not directly. Security Copilot does not execute arbitrary PowerShell commands like a runbook or automation platform would. However, it appears technically feasible to accomplish similar outcomes by triggering automation through existing Microsoft services. It… Read More: Can Security Copilot Agents Run PowerShell? »
KQL is easy to learn, efficient, readable, and perfect for daily hunting and incident response. It powers queries across Microsoft Sentinel, Azure Monitor Logs, and the Advanced Hunting experience in Microsoft XDR. Every time you open the Logs blade or run a query in the portal, you are using KQL to explore the Analytics Tier.… Read More: Analyzing Sentinel Data with Python »
What It Really Looks Like to Study Artificial Intelligence Online A decade ago, most universities treated artificial intelligence as a single elective buried deep inside computer science. It was the kind of class you took after surviving data structures, algorithms, and a heavy dose of calculus. That began to change in 2018, when Carnegie Mellon… Read More: Looking for an online AI degree? »
Another Unforgettable Black Hat & DEF CON Week I landed in Las Vegas and checked into Circus Circus, a no-frills spot but close enough to DEF CON to make the walk easy. It felt like the right basecamp for a packed week. My 4th hacker summer camp! Tuesday was about arrivals, badges, and parties. I… Read More: Hacker Summer Camp 2025 »
With so many Large Language Models (LLMs or GPTs) available today, how do you know which one to use? The truth is, there isn’t a single “best” model. Instead, the right choice depends on your specific needs and the tools you have at hand. General-Purpose LLMs Text-based LLMs like ChatGPT, Gemini, and Microsoft Copilot are… Read More: Choosing the Best AI Model »
Vibe Learning is a new approach to education that uses AI tools like ChatGPT and Copilot to create a fast, interactive, and engaging learning experience. By shifting from traditional study methods to conversational exploration, learners can accelerate understanding, focus on what matters, and build knowledge more efficiently.
I was explaining my career progression to a new mentee recently, someone new to IT, and it got me thinking about how, early in life, it can be unclear how someone might transition through multiple jobs or careers. For many, these transitions are driven by interest, necessity such as being laid off, or a drive… Read More: Thinking Back on Career Transitions »
Introduction Microsoft released Security Copilot worldwide on April 1, 2024. This service provides a natural language, generative AI assistant for Security Operation Center (SOC) analysts. Security Copilot is a generative AI-powered chat assistant add-on designed for various Microsoft Security tools. It enables security analysts to converse with an AI assistant, share conversations, and use generative… Read More: Microsoft Security Copilot Alternatives »
A simplified approach to following the DOD (U.S. Department of Defense) Zero Trust roadmap using Microsoft security solutions. Introduction The DoD Zero Trust Portfolio Management Office (ZT PfMO) released the Department of Defense Zero Trust Strategy and Roadmap on Nov 22, 2022. It defined what the DOD needs to do to execute Zero Trust. A… Read More: DOD Zero Trust with Microsoft Made Simple »
I’m still recovering from my third year at Black Hat and DefCon. The physical and emotional exhaustion, social overload, and post-event sniffles are all signs of a great conference. This year, I added an extra day for the first-ever Black Hat AI Summit. I was drawn to the topic, the networking opportunities, and my usual… Read More: Hacker Summer Camp 2024 »
I returned from my second Hacker Summer Camp a few weeks back, Black Hat and DEF CON, and I’m excited to share my observations and notes. What is Hacker Summer Camp? DEF CON was started by Jeff Moss (known as Dark Tangent) at the age of 18 in 1993, with around 100 attendees, and it… Read More: Hacker Summer Camp 2023 »
Are your Entra ID (AAD) logs getting too expensive in Sentinel? I have a theory on this. These logs appear to be created primarily for reporting purposes. Optimal sizing may not have been a primary consideration. In my experience these logs can grow rapidly and may become too expensive to retain in Sentinel. The two… Read More: Ways to reduce Entra ID (AAD) log size in Microsoft… »
It is often necessary to setup alert or ticket integration between two monitoring solutions. For example, sending alerts from one system to an ITSM or SIEM. I will refer to the data being transferred as alerts here for simplicity. Where do you start? First determine your requirements: Look for out of the box and community… Read More: How to design a ticket integration solution? »
There are many opportunities in our professional lives to provide feedback on peers, managers, company direction, instructors, vendors, etc. You may be tempted to use these opportunities to focus on the negative by providing constructive criticism and negatively weighted responses. I suggest that you consider focusing on the positive. Consider that these feedback requests are… Read More: Providing constructive criticism on professional feedback requests »
At some point in your technical career, someone is going to ask you to research a new technology and to educate others on what you learned. Maybe you are a SME, consultant, salesperson, instructor, or you simply drew the short straw. I have been fortunate to experience this process many times in my professional career.… Read More: How to learn like a teacher »
Forged in Fire is a great analogy for a job interview. Forged in Fire is a one-hour blacksmithing competition show where four contestants compete in three rounds to identify the Forged in Fire Champion. Each round involves sword and knife forging competitions. Professional and amateur blacksmiths compete in timed rounds to forge weapons within specific… Read More: 10 Interview Tips Inspired by Forged in Fire »
Here are some useful links for job seekers. I will update the list periodically.
Microsoft Specific, Resume Services, Soft Skills, Cyber Learning, Tech Training, Vet Resources, Tech Projects
Here is a list of over 1,000 hours of book recommendations (70 titles) from an audiobook and podcast addict. Walking, driving, shopping, cleaning, or just relaxing. Hopefully I can share my addition with others. May you also get strange looks from onlookers as you laugh unexpectedly or carry a silly grin or intense scowl. Enjoy!… Read More: Audiobook Reading List »
The two most important interview questions in my opinion are around your passion for technology and the company. Interviewers want to know that you are technology focused and that you are particularly interested in serving their organization. How do you stay up on technology? The core of this question is an attempt to assess your… Read More: Two most important technical interview questions »