When using Microsoft Sentinel you can connect multiple sources as data connectors. By default all connected sources will ingest their information to predefined tables in the Log Analytics workspace, backing the Microsoft Sentinel instance. You then can query this data using analytic rules or hunting queries to identify abnormal behavior. But for a few of those data connectors Microsoft is offering an additional feature called “User and Entity Behavior Analytics” or UEBA for short.

At my companies bootcamp, a few colleagues and I did research on the different Azure Active Directory tokens and authentication flows. At the end of the week one question remained unanswered Frage How does the usage of continuous access evaluation (CAE) and the extended lifetime of the access token impact security? So, after I returned home, I started digging into this topic to answer the question. OpenID Connect, OAuth2 and token Let’s back up a second and look at the current implementation of the different protocols involved in authentication and authorization to better understand the need for CAE.

Microsoft just announced the public preview of the new Device Health Reporting for Microsoft Defender for Endpoint and I already love it. It not only gives you deeper insights into your environment but also adds much needed information like engine version, last scan time, and scan results. Sensor health & OS Sensor health & OS overview This overview gives you insights into deployed OS versions, the current state of the sensor health and for Windows 10 there is an extra section that shows the different releases deployed in your environment.

The development of Microsoft Defender for Endpoint is an ongoing process and as such the features and capabilities change over time. Microsoft Defender Antivirus exclusions are no exception. On 22.06.2022 Microsoft released the platform version 4.18.2205.7 of MDAV and with it a new exclusion category “Contextual file and folder exclusions. This type of exclusion brings additional flexibility and allows fine grade scoping of file and folder exclusions. Of course this meant to update my post Hitchhiker’s Guide to Microsoft Defender for Endpoint exclusions” to include this new type of exclusion.

One of the features of Microsoft Defender Antivirus that, in my opinion, is overlooked by most, is the ability to control the rollout of all components of Microsoft Defender Antivirus by selecting different release channels. This allows for a more gradual rollout of security intelligence updates, the engine as well as the AV platform. Different update types But let’s take a step back and get a common understanding whats the difference between those different updates is and how they are deployed.

One thing that always makes analyzing Sign-In logs for Entra ID (Azure AD) users a bit complicated is the different types of Sign-In logs available. For user accounts “Interactive user sign-ins” as well as “Non-interactive user sign-ins” are where to look. And don’t get me wrong, I love that we have the non-interactive logs available. They are super important and the separation is correct. But when working with those logs in the Azure portal is get’s complicated fast.