Orphaned Azure Security Principals Clean-up & Azure Policy Managed Identity Role Assignment Automation
This blog covers 2 topics : (1) how you can automate clean-up of any orphaned security principal role assignments – …
Automate Reporting of Defender for Cloud recommendations & Role Assignments with 35 different views
Background Recently, I was asked to build a simple reporting-script, which integrates data from Microsoft Defender for Cloud and Azure …
How to implement a gradual (ring) rollout-process for Microsoft Defender updates
It is important to ensure that your security posture systems are up-to-date to be able to prevent attacks. Microsoft Defender …
How to save $$$ by storing your Syslog and Defender for Endpoint long-term logs in Azure Data Explorer cluster using Azure Data Factory and Azure Storage Account export – while keeping Kusto query functionalities ?
This blog is about keeping long-term Sentinel logs, giving you insight to the options today – with great opportunities to …
Sentinel Alert Rules Management with Add / Update / Remove & Alert Rule Action automation
Do you want to automate alert rules including creating new alert rules and update existing – with checks every x …
Real example with 43% cost savings on Sentinel log-costs: How to exclude Syslog log-events from banned IPs using AbuseIPDB-service with integration to firewalls
This is a real-life example of how I helped reduce the log-cost by 43% for LogAnalytics & Sentinel combined for …
Microsoft Defender Antivirus Performance Analyzer – understand which files, file extensions, or processes that might be causing performance issues on endpoints during antivirus realtime protection scans
Have you ever wondered what is causing your ‘Antimalware service executable’ (Defender Antivirus) to spike the CPU for longer times? …
How to do a Password Audit of your Active Directory passwords using DSInternals?
Great job Michael Grafnetter Initially, I would like to thank the author of DSInternals, Microsoft MVP Michael Grafnetter, for creating …
How to run custom scripts on thousands of servers within a few minutes using Azure Custom Scripts extension and multithreaded jobs – and have them re-run daily?
Have you ever had a need to collect vital configuration status (inventory) from thousands of servers – with a defined …
How to migrate from Qualys and enable Microsoft Defender Vulnerability Management (MdeTvm) in Microsoft Defender for Cloud?
Microsoft’s Defender Vulnerability Management is a built-in module in Microsoft Defender for Endpoint that can: If you’ve enabled the integration with Microsoft …