Using Defender XDR Advanced Hunting as a Cross-Domain Lens

Understand how Microsoft Defender XDR advanced hunting complements Azure telemetry by joining endpoint, identity, email, app, and Sentinel signals.

Designing Microsoft Sentinel Around Normalized Signals

Use ASIM and source-aware design to make Microsoft Sentinel detections more durable across changing Azure and hybrid telemetry sources.

Collecting Azure Resource Logs Without Creating Noise

Use diagnostic settings and routing decisions to turn Azure resource logs into useful security telemetry instead of expensive noise.

Azure Security Telemetry: Start with the Control Plane

Build the first layer of Azure security telemetry around activity logs, diagnostic settings, and control-plane accountability.

Operating an Azure Exposure Management Program

Continuous Exposure Monitoring with Sentinel and Workbooks

Hardening Internet-Facing Assets with Policy and Automation

Prioritizing External Risk with Attack Path Context

Discovering Shadow IT with Azure Exposure Management

Azure Attack Surface Management in Defender EASM