AI Agents Agent Builder vs Copilot Studio: Pick the Tool, Then Govern It Agent Builder and Copilot Studio aren't two skill levels. Four questions pick the tool, and the choice decides which admin console, and which sharing rules, govern the agent.
AI Agents AI Agent Incidents: Ask Which Identity Acted, Not Why NIST, the NSA, and CISA now treat an off-script AI agent as an incident to rehearse. You will not learn why it happened in time, but you can know which identity acted, if Entra is set up first.
Microsoft 365 Microsoft 365 G7 vs G5 for GCC: 12 of 26 Agent 365 Capabilities G7 is on sale for GCC, but Microsoft's own service description marks 12 of Agent 365's 26 capabilities available there, and none of the Purview controls for agents. Here's what G7 adds over G5, and when to wait.
Microsoft Security Project Perception: Let AI Agents Test If You're Protected Microsoft's Project Perception turns "are we protected from this threat actor?" into a tested answer in Defender. The real decision is which steps you let agents run alone.
AI Tools I Built My Own Wispr Flow on Azure Foundry With Codex I wanted AI dictation on my work laptop without sending text to a vendor or installing a local model. Here is how Sasayaki runs on my own Azure subscription, how to install it, and what it costs.
AI Agents Copilot Studio Evaluations: Test Your Agent Before Users Do Copilot Studio now builds agents, workflows, and apps from a prompt. Evaluations is the release gate that keeps easier building from meaning untested agents in front of users.
Microsoft Security Is Windows Defender Good Enough in 2026? It Depends Which One Built-in Defender Antivirus is strong for one home PC. Businesses need devices onboarded to Defender for Endpoint or Defender for Business. Here is how to tell which one you have.
Microsoft Security Digital Defense Report 2026: Three Actions for Defender and Entra Teams Microsoft's 2026 Digital Defense Report says attackers are adopting AI faster than defenders. Here are the three findings to act on this quarter, with the Defender, Sentinel, and Entra controls that address them.
Studying with NotebookLM This post shows a better way. You take existing study material and turn it into podcasts and quizzes. You listen while walking the dog. You test yourself without building flashcards by hand. The content stays focused. The effort drops. YouTube Video #LearningSystems #SelfStudy #SmartStudying #PodcastLearning #QuizBasedLearning #ActiveLearning #KnowledgeRetention #StudyAutomation 1.
The Messy Reality of the Modern Workday I just read the exceptional whitepaper from Perplexity titled "Perplexity at Work: A Guide to Getting More Done" If your desk is a battlefield of open tabs, your inbox gives you anxiety, and you feel like you spend more time managing technology than actually working, you’re experiencing
GenAI vs. Cyber Threats: Why Unified Security Operations are Your Unbeatable Defense The relentless evolution of cyber threats has ushered in a new era of digital warfare. Attackers, armed with sophisticated automation and artificial intelligence, are launching more complex, faster-moving assaults that strain traditional security defenses to their breaking point. In this escalating cyber arms race, a crucial announcement from October
Reducing Alert Fatigue in the SOC: How to Handle Benign Positives, False Positives, and True Positives Alert fatigue is one of the biggest threats to SOC effectiveness. Analysts drowning in low-value alerts are more likely to miss the real threats. To fix this, you must know your alert categories and handle each one differently. The Three Core Alert Categories 1. Benign Positive * Definition: A real
Protecting Your Microsoft Sentinel Solution from Deletion or Corruption Microsoft Sentinel is a cloud-native SIEM and SOAR solution that helps organizations collect, detect, and respond to security events at scale[7]. Because Sentinel relies on cloud resources (like Azure Log Analytics workspaces) to store and analyze data, it's crucial to safeguard these components against accidental deletion
From Kathmandu to Everest Base Camp: A Journey of Resilience and Discovery Day 1 - 9/29/2024 - Kathmandu After a marathon 24-hour journey, we finally touched down in Kathmandu, having flown through the opulent Doha, Qatar. The landing was nothing short of spectacular, with the skyline showcasing some of the most stunning architecture I've ever seen. The airport itself
Demystifying Log Collection in Azure: Navigating Windows and Linux Server Logging for Microsoft Sentinel I'm crafting this blog post to shed light on the target tables in Log Analytics, specifically for non-Azure server logs. Just a heads-up: this article won't cover the setup process for log ingestion. However, I'll make sure to include pertinent links throughout.
Identifying Security Weakness in Function Apps and Storage Accounts BLUF: If an adversary can List Keys on a storage account that contains Azure Function, they can already modify the Azure Function because the only person that can List Keys is the owner of the Storage Account and any inherited owners. I recently had a customer ask to get a
Microsoft Sentinel Pricing and Monitoring When I meet with customers for the first time, the cost of Microsoft Sentinel is a common topic of discussion. I'm updating this blog to reflect recent pricing model changes and include additional pricing considerations. It's important to note that this isn't an analysis
Ensure Critical Log Collection in Microsoft Sentinel This solution was inspired by one of my customers. They wanted to know if they could use a Microsoft Sentinel Watchlist in combination with Usage logs to be alerted if they were no longer getting log data on one of their collections. For this example, I created a Watchlist that
Microsoft Sentinel Log4j Ubiquiti Analytic Rule I created a quick Analytic Rule for those using Ubiquiti logs with Microsoft Sentinel. First of all, I just took two existing rules and made a new one. To get the IOCs for Log4j published on the Sentinel GitHub page, I utilized the code from a recently published rule in
Microsoft Sentinel Azure AD Connector Log Breakdown I have been getting a lot of questions from customers about the configuration of the Azure AD Connector in Microsoft Sentinel. OK, I have not been asked, but just in case I am, I want to be sure I can explain the various logs ingested by Microsoft Sentinel. The Azure
Microsoft Sentinel Log Usage Recently I had a customer, well more than one, that wanted to understand the usage and cost of their ingestion of log data into Sentinel. First, the ingestion cost for Sentinel can be confusing because you also pay for ingestion into Log Analytics. I am hoping this will be made
Azure Sentinel GCIA and Sentinel Recently I completed my GCIA [https://www.giac.org/certification/certified-intrusion-analyst-gcia] (GIAC Certified Intrusion Analyst) certification, which focuses on hunting for adversaries. The course and exam focus on monitoring, network traffic analysis, and intrusion detection. The benefit of this course is two-fold. First, it directly engages
Advanced Threat Protection by Microsoft I just wanted to throw together a quick post explaining the differences between the "Advanced Threat Protection" solutions from Microsoft. These different offerings sometimes confuse me, and I work for Microsoft. So let me start from the desktop and soar to the cloud. Keep in mind, all these
Azure Flow Log Aggregation (SOF-ELK) I recently completed the SANS FOR572 | Advance Network Forensics: Threat Hunting, Analysis, and Incident Response course delivered by Phil Hagen [https://www.linkedin.com/in/philhagen/] and the tested and certified in GIAC Network Forensic Analysis (GNFA). During my study time I wanted to dig deeper into the SOF-ELK
Automated Azure Cyber Lab I just wrapped up an Azure Government Hack-a-thon, where our team had to come up with a solution based on five different scenario choices. Now this is not a hack-a-thon from the perspective of penetration testing. It was a make-it-real type of training and
