Designing Microsoft Sentinel Around Normalized Signals

Use ASIM and source-aware design to make Microsoft Sentinel detections more durable across changing Azure and hybrid telemetry sources.

Collecting Azure Resource Logs Without Creating Noise

Use diagnostic settings and routing decisions to turn Azure resource logs into useful security telemetry instead of expensive noise.

Azure Security Telemetry: Start with the Control Plane

Build the first layer of Azure security telemetry around activity logs, diagnostic settings, and control-plane accountability.

Operating an Azure Exposure Management Program

Continuous Exposure Monitoring with Sentinel and Workbooks

Hardening Internet-Facing Assets with Policy and Automation

Prioritizing External Risk with Attack Path Context

Discovering Shadow IT with Azure Exposure Management

Azure Attack Surface Management in Defender EASM

Governing Workload Identity: Review Cadence, Drift Detection, and Architecture Accountability

Workload identity posture decays through accumulated exceptions, making governance a recurring architectural discipline rather than a one-time control exercise.