🧰 Microsoft Sentinel

The items that name it 21

• AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
  writeupas classification.technologies2026-10-21
• DFIR Radar (@DFIR_Radar) on X
  threadas classification.technologies2026-10-19
• Tracking CVE-2026-73570: unauthenticated command injection on internet-facing mail servers
  writeupas tools2026-09-30

  Recommended for hunting activity older than the 30-day Advanced Hunting retention window, by searching second-stage infrastructure listed in the appendix or archived logs.

• Star Blizzard refines phishing and malware delivery with the RedFlick technique
  writeupas tools2026-09-29

  TI Mapping analytics and ASIM-based hunting queries to match malicious domain/IP/file hash IOCs

• NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
  writeupas tools2026-09-28

  SIEM; TI Mapping analytics ('TI map') used to automatically match malicious domain indicators with workspace data

• Adversarial-Detection-Engineering/adeskills
  repoas affected products2026-09-27It is written here as Microsoft Sentinel (detection rules).

  public ruleset analyzed for detection-logic bug patterns

• Storm-3168: Agentic-driven cloud attacks using compromised service principals
  writeupas tools2026-09-25

  Plugin integration referenced for Security Copilot promptbooks

• ThreatIntel-Aggregator
  repoas tools2026-09-17

  SIEM integration target for Analytics Rules and Hunting queries, synced via ARM

• Passkey-themed social engineering leads to identity and cloud compromise
  writeupas tools2026-09-09

  Plugin integration referenced for running Security Copilot promptbooks and advanced hunting.

• Orca Security: SOC Automation
  articleas tools2026-08-14

  Automation rules that fire when an incident is created or updated, or when an alert is created, and call playbooks for more complex actions; executes automation rules sequentially, advancing to the next action if a playbook runs longer than two minutes regardless of completion

• [tl;dr sec] #340 - Anthropic and Meta Agents be Hackin', Agentic Incident Response Notebooks, Figma's AI Code Scanning
  articleas tools2026-08-07

  Queried with KQL through the notebook SDK.

• Orca Security: Incident Response Tools
  articleas tools2026-07-31

  Cloud-native SIEM with a separate data lake tier for cheaper long-term retention and native correlation with the Microsoft security stack (identity, endpoint, email).

• XORCISM-AI/XORCISM
  repoas tools2026-07-01

  SIEM API import connector

• Operational Workbooks Episode 1: Running a Playbook from a Workbook
  articleas affected products2026-04-12

  SIEM platform where Workbooks are built to drive playbooks

• Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure
  writeupas tools2026-03-23

  SIEM used for provided detection/hunting queries against sign-in logs (SigninLogs, AADNonInteractiveUserSignInLogs)

• Using KQL to Detect Gaps in your Conditional Access Strategy
  writeupas classification.technologies2025-03-23
• Optimizing the SOC
  articleas affected products2024-12-07

  SIEM platform; data collection, workbooks, analytic rules, alerts discussed

• Today I Learned - NSG Flow Log
  writeupas tools2024-09-21

  integrating flow logs for detailed traffic analysis and real-time monitoring

• Practical Temporal Proximity in KQL
  writeupas classification.technologies2024-09-15
• Stack Your Deception: Stacking MDE Deception Rules with Thinkst Canarytokens
  writeupas tools2024-04-21

  SIEM where incidents are created from Canarytoken email alerts via the Azure Logic App

• Enhancing Your Entity Timelines: Sentinel Activities in the Unified Microsoft Defender XDR Portal
  writeupas affected products2024-04-13

  Entity behavior / activities feature, integrated into Defender XDR portal (preview feature)