2 posts tagged with "Microsoft Sentinel"

Eventus published a Qiita article, “Shifting Phishing Investigations from a Single Email to a Campaign: Scoping Impact with Defender XDR and Sentinel”. The Japanese title is 「フィッシング調査を『1通のメール』から『キャンペーン単位』に切り替える―Defender XDRとSentinelで影響範囲を出す」.

Eventus published a Qiita article, “Designing Sentinel User Behavior Analytics Without Raw-Table Dependencies: Using ASIM Authentication as the User Baseline”. It looks at why analytics built directly on SigninLogs, SecurityEvent, and connector-specific logs become harder to maintain as authentication sources multiply. High raw-event volumes can also hit query result limits, while connector or ingestion gaps can leave missing data.