Whoop!, Whoop 🎉 I've earned my 5th consecutive MVP award! Now is a great time to start my vacation and think about security and AI stuff next time in August!

New in #DefenderXDR advanced hunting: Automatic Attack Disruption events are now in the DisruptionAndResponseEvents table! 🛡️ - Includes both block & policy-application events from disruption policies, plus auto-response actions across related workloads - Boost visibility into complex attacks

Spent the week test-driving the Microsoft Learn Docs MCP server with the Claude desktop. Fast, precise document look-ups make it easy to ground answers in official Microsoft content. Links: - github.com/microsoftdoc... - techcommunity.microsoft.com/blog/azurede...

I tried #Lokka MCP server made by @merill.net . Lokka bridges Claude to Entra/Azure via Microsoft Graph. I exported Entra security settings through APIs, parsed CA policies, and drafted a report with the Claude desktop. Early days, but looks promising! #CloudSec #MCP lokka.dev/docs/intro/

Storm-2372 conducts a device code phishing campaign. Update on Feb 14, 2025: 'Within the past 24 hours, MS has observed Storm-2372 shifting to using the specific client ID for MS AuthBroker in the device code sign-in flow. Read the full story below 👇 www.microsoft.com/en-us/securi...

The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation www.microsoft.com/en-us/securi...

Next-Gen Device Incident Investigation & Threat Hunting with Custom Plugins in #Securitycopilot techcommunity.microsoft.com/blog/securit...

EntraOps repository: github.com/Cloud-Archit... Learn more about XSPM and Graph: Deep Dive blog post on XSPM by @samilamppu.bsky.social samilamppu.com/2024/04/25/m... Blog posts by @fabian.bader.cloud cloudbrothers.info/en/workshop-... cloudbrothers.info/en/find-late... Kusto Graph rocks! (3/3)

Unified Device Timeline Experience in Microsoft SIEM + XDR techcommunity.microsoft.com/blog/microso...

Sentinel Content Hub leverages AI technology in the new search capability. Check out below how techcommunity.microsoft.com/blog/microso...

Speed up incident triage with Security Copilot and Microsoft Sentinel techcommunity.microsoft.com/blog/securit...

Hunt for identity-based threats with Security Copilot and Microsoft Sentinel techcommunity.microsoft.com/blog/securit...

Blog summarizes the three takeaways from the Microsoft AI Red team white paper: 'Lessons from red teaming 100 generative AI products' www.microsoft.com/en-us/securi...

#MicrosoftEntra Attack & Defense Playbook Update: @samilamppu.bsky.social and I have updated some content: 🔃 #EntraConnect: New capabilities by MDI sensor & XSPM 🎯 #AiTM: Attack scenarios on MDA sessions 🛡️ #MITRE: Updated TTP coverage & map Check out the latest version: github.com/Cloud-Archit...

Together with @naunheim.cloud we did the following updates on Entra ID Attack & Defense Playbook: Entra Connect: Added MDI enhancements and XSPM queries AiTM: MDA section with Edge In-browser MITRE: Updated heat map & TTPs Check out the latest version 👉 github.com/Cloud-Archit...

Defender XDR monthly news - January 2025 techcommunity.microsoft.com/blog/microso...

KQL Migrator powered by Microsoft Security Copilot techcommunity.microsoft.com/blog/securit...

Leveraging ASIM-based KQL plugins in Microsoft Security Copilot for investigation scenarios techcommunity.microsoft.com/blog/securit...

Looking for how to audit Security Copilot activities? Great Techcommunity blog explains how. Monitor user activities & system events with Security Copilot and Sentinel 👇 techcommunity.microsoft.com/blog/securit...

Unified SOC Operations Platform latest enhancement: Use Sentinel Workbooks directly from the Defender XDR portal techcommunity.microsoft.com/blog/microso...

#MSUGFI aka 'Microsoft Security User Group Finland' kokoontuu seuraavan kerran keskiviikkona 15.1.2024 klo 17:00, jolloin hostina toimii Arrow ECS. Vielä olisi muutama paikka vapaana, jos event kiinnostaa nappaa itsellesi sisäänpääsy tapahtumaan linkin takaa 👇 www.meetup.com/microsoft-se...

Defender XDR monthly news - December 2024 edition techcommunity.microsoft.com/blog/microso...

It's great to see SaaS initiative in Defender for Cloud Apps & Exposure Management announced! A lot of work behind the scenes in private preview phase! learn.microsoft.com/en-us/defend...

New Release: #EntraOps 0.3.3! 🚀 This update includes bug fixes and enhancements to #MicrosoftSentinel workbooks and nested #MicrosoftEntra PIM for Groups. Get the latest version from the GitHub repository: github.com/Cloud-Archit...

Yesterday, I was privileged to share a stage at the MSUGFI with fellow MVP and good friend Joosua Santasalo. We focused this time only on AiTM attacks, and on a high level, we covered: Attack simulation, discussed the effective detections, mitigations Thanks to everyone who joined the session!

Celebrating 4 years of the "#MicrosoftEntra Attack & Defense Playbook" 🔐 ☁️ community project! Last week, we (@naunheim.cloud & I) were in Chicago, and we took the opportunity to record a video about this project's journey. #MVPBuzz #TechCommunity youtu.be/fBD1ftf0PbA?...

Ready for day 3 at the MS Ignite on the Security Copilot booth!

Here we go! MS Ignite day 2 starts with Entra Suite stuff!

Day 1 behind at MSIgnite. Great discussions, questions and connections. If you are at the MSIgnite & wanna have a chat, come to meet me at the SecurityCopilot booth on Thursday morning.

Huge improvements were announced for the security copilot in the MS Entra embedded experience at Ignite. bit.ly/4hPpTyN

Here we go, ready for MSIgnite!

Microsoft Defender Experts (DEX) plugin is a great example of a powerful KQL plugin in Copilot for Security. Full story on the blog: bit.ly/3O8jW23

We (Markus, Thomas & me) are excited to announce the next version of Entra ID Security Config Analyzer - EIDSCA (V3). This release includes some overall improvements and a new section to track your Entra ID Conditional Access policies. You can find the solution at bit.ly/3PtI3Kq

Exited to announce that Raghu & I are releasing 'Microsoft Unified XDR and SIEM Solution Handbook' in March. Our book goes deep into the Unified XDR Solution - breaking down its capabilities and demonstrating effectiveness in real-world attack scenarios. www.amazon.com/dp/1835086853

New Microsoft Incident Response guides help security teams analyze suspicious activity | Microsoft Security Blog www.microsoft.com/en-us/securi...

Introducing the new PowerShell Module for Microsoft Defender for Identity - Microsoft Community Hub techcommunity.microsoft.com/t5/microsoft...