I was working with a customer recently who was trying to track down changes across several subscriptions. Nothing unusual there, except we quickly realized something was missing. A number of subscriptions were not sending Azure Activity Logs to Microsoft Sentinel at all. No errors, no alerts, just silent gaps. It stood out because this is… Read More: Azure Activity Logs: A Few Practical Tips »
I put together a small project called Global Threat Atlas. It started out simple, and 500+ commits later it turned into something production-ready. It can be deployed today in Azure commercial subscriptions. This is built with an operations center in mind. It works well as a glanceable wallboard, but you can also interact with it… Read More: Global Threat Atlas – Public Release »
I recently worked with a customer who had done the right thing from a security perspective. They followed the best practice of separating standard user accounts from privileged admin accounts. Day-to-day work was done with a normal account, and elevated tasks required a separate admin identity. What they chose not to do was record the… Read More: Reconnecting Admin and User Accounts in Entra »
I recently built an Azure Monitor workbook to help customers who are struggling to verify that all Azure virtual machines are fully onboarded to Microsoft Defender for Endpoint (MDE). Repo: AndrewBlumhardt/workbooks In theory, this should be straightforward. When Defender for Servers is enabled as part of Microsoft Defender for Cloud, Azure VMs are automatically onboarded… Read More: Verifying MDE Protection for Azure VMs »
I recently ran into confusion around Azure Logic Apps that came from viewing them through a Power Automate lens. On the surface the two platforms look nearly identical. They share connectors, workflows, and even the same HTTP action. But applying Power Automate’s security assumptions to Logic Apps leads to incorrect conclusions about risk, governance, and… Read More: Securing Power Automate vs. Azure Logic Apps »
Vibe Learning is a new approach to education that uses AI tools like ChatGPT and Copilot to create a fast, interactive, and engaging learning experience. By shifting from traditional study methods to conversational exploration, learners can accelerate understanding, focus on what matters, and build knowledge more efficiently.
Are your Entra ID (AAD) logs getting too expensive in Sentinel? I have a theory on this. These logs appear to be created primarily for reporting purposes. Optimal sizing may not have been a primary consideration. In my experience these logs can grow rapidly and may become too expensive to retain in Sentinel. The two… Read More: Ways to reduce Entra ID (AAD) log size in Microsoft… »
It is often necessary to setup alert or ticket integration between two monitoring solutions. For example, sending alerts from one system to an ITSM or SIEM. I will refer to the data being transferred as alerts here for simplicity. Where do you start? First determine your requirements: Look for out of the box and community… Read More: How to design a ticket integration solution? »
I recently passed AZ-500! I found the exam to be rather challenging; partially due to a lack of training resources. Here is a brief summary and some general prep-tips in case you are heading down the same path. Exam AZ-500: Microsoft Azure Security Technologies This a broad exam covering many topics. I recommend passing at… Read More: AZ-500 Exam Tips »
Here is the last ported post from my old bog site. The vast archive of SCOM knowledge (3 full posts) have now been migrated to the new blog! I’ve worked with a variety of management packs over the years. One headache that I have often encountered when implementing a new MP has been the inconsistency… Read More: SCOM Object Discovery Troubleshooting »
Here is another article ported from my old blog dating back to 2012. I recently revised a few key points. Once again, these observations haven’t changed significantly over time. Deploying SCOM Agents using the Discovery Wizard appears to have at least four distinct phases: setup, discovery, installation, and initialization. Each of these stages has unique… Read More: SCOM Agent Deployment Troubleshooting »
Here are some SCOM tuning tips that I published back in 2012 that are just as relevant today as they were back then. This was taken from a SCOM support guide that I created for a large insurance company. Reasons why we create new MP rules and monitors: To generate new monitoring that was not… Read More: SCOM Tuning Tips »