If you can completely disable device code flows using Conditional Access, you should do so. If you cannot, at least limit which user IDs can use them. If you allow any users to use device code flows, use the #KQL provided to hunt for abuse.

#cybersecurity #microsoft

From: @fabian_bader
https://infosec.exchange/@fabian_bader/114013896376345681

​ 20% OFF for "Hands-On Kusto Query Language (KQL) for Security Analysts" course!

The course just got a revamp, tailored specifically to meet the needs of analysts. It's now more accessible and offers lifetime access!

Use "ANALYST23" at the checkout as a holiday gift for 20% OFF!
(Expires 31.12.2023)

Don't worry, you can start your lab access period whenever you want!

​https://academy.bluraven.io/hands-on-kusto-query-language-kql-for-security-analysts

Hey folks, the first draft of the #kql book is nearly done. We’ve put a ton of time into this and we got some really nice bonuses throughout. We’ve been talking to lots of different teams at #Microsoft and getting recommended operational and security #kql queries you should be running in your environment for a bunch of areas. If you’re using #entraid #Microsoft365 or #Azure you’ll get something out of it. The book is up on Amazon now https://www.amazon.com/Definitive-Guide-Kql-Operations-Defending/dp/0138293384?&linkCode=sl1&tag=buzzmanagement&linkId=e975cc8d41fb9e856d34192c5f24c708&language=en_US&ref_=as_li_ss_tl and will be on the MS Press store in about a month. Really looking forward to getting this out there for everyone.

Sneak Peek at my upcoming "Hands-On KQL for Security Analysts" Course!
Preview lessons are now live! Plus, a #BlackFriday discount is on the horizon!

Check the preview: https://academy.bluraven.io/hands-on-kusto-query-language-kql-for-security-analysts
#KQL #MicrosoftDefender #MicrosoftSentinel #Training

Want to use multiple languages in a notebook while getting rich IntelliSense? Check out the #vscode Polyglot Notebooks extension, now in GA!

#polyglotnotebooks has language server support and variable sharing for C#, JavaScript, SQL, & more!
https://aka.ms/PolyglotNotebooksGA

Next week at #BlueHat, I'll have several signed copies of the Must Learn KQL paperback books to raffle off in the Cyber village https://amzn.to/3jjIDNi

Today, I’m excited to share my experience testing the integration of ChatGPT with Microsoft Sentinel. My goal with this integration was twofold: to have some fun experimenting with this cutting-edge technology and to explore how it could be used to empower security analysts in incident handling.

https://medium.com/@antonio.formato/chatgpt-and-microsoft-sentinel-simplify-the-incident-handling-process-7f1c6a1ed925

ARM template to deploy my demo playbook: https://github.com/format81/MicrosoftSentinel-ChatGPT-playbook

Window functions are amazing!

I also shared a query for #cloud account takeover detection.

#ThreatHunting #DFIR #DataScience #KQL

https://posts.bluraven.io/advanced-kql-for-threat-hunting-window-functions-part-1-14ac09353ad3