Eventus published a Qiita article, “Shifting Phishing Investigations from a Single Email to a Campaign: Scoping Impact with Defender XDR and Sentinel”. The Japanese title is 「フィッシング調査を『1通のメール』から『キャンペーン単位』に切り替える―Defender XDRとSentinelで影響範囲を出す」.
Eventus published a Qiita article, “Designing Sentinel User Behavior Analytics Without Raw-Table Dependencies: Using ASIM Authentication as the User Baseline”. It looks at why analytics built directly on SigninLogs, SecurityEvent, and connector-specific logs become harder to maintain as authentication sources multiply. High raw-event volumes can also hit query result limits, while connector or ingestion gaps can leave missing data.
I recently published a new article on Qiita about why simply adding AI on top of SIEM is not enough.
Eventus is joining Qiita, Japan's technology knowledge-sharing platform, to share practical experience with engineers, IT teams, and technology leaders. Qiita gives us a place to share what we have learned while helping organizations improve security operations, use cloud technologies, and make better decisions from operational data.