PinnedEntra: what is actually broken in your tenant this week?
0 replies · 1 views
PinnedSentinel: what do you actually work in it, and what do you ignore?
0 replies · 1 views
PinnedDefender for Endpoint: how do you triage the alert queue?
0 replies · 1 views
PinnedDefender XDR: how do you work an incident, start to finish?
0 replies · 1 views
Defender for Office 365: what do you still release from quarantine by hand?
0 replies · 2 views
Entra Connect or Cloud Sync: what still has to be fixed on-premises?
0 replies · 1 views
Conditional Access: what do you run in report-only, and why have you not turned it on?
0 replies · 1 views
Threat analytics: do you read it, or only when something is already in the news?
0 replies · 1 views
Analytics rules: which built-in rule have you had to tune, and how?
0 replies · 1 views
Automatic attack disruption: have you let it act, or do you still confirm first?
0 replies · 1 views
Dynamic groups: which rule do you trust, and which one keeps surprising you?
0 replies · 1 views
Containment: when do you isolate a device, and when is that too much?
0 replies · 1 views
Live Response: when do you use it, and when do you refuse?
0 replies · 1 views
Device timeline: what do you look for in the ten minutes before the alert?
0 replies · 1 views
PIM: what did you put behind activation, and what did you leave standing?
0 replies · 1 views
Defender Vulnerability Management: do you act on it, or is it a report?
0 replies · 1 views
Custom detection rules: which one has caught something the built-in rules missed?
0 replies · 1 views
Guest access: what do you allow, and what did a guest do that you did not expect?
0 replies · 1 views
App registrations: who is allowed to create one, and how do you find the ones nobody owns?
0 replies · 1 views
XDR and Sentinel: do you send incidents across, or do you work them where they land?
0 replies · 1 views
Incidents that should have been one, and arrived as ten
0 replies · 1 views
Break-glass accounts: when did you last sign in with one?
0 replies · 1 views
Tamper protection and exclusions: how do you keep local admins from undoing Defender?
0 replies · 1 views
Defender for Identity: what alert has actually been worth waking up for?
0 replies · 1 views
Sign-in logs: what do you look at first when a user says they cannot get in?
0 replies · 2 views
Advanced hunting: the query you run on every incident
0 replies · 2 views
Retention: what do you keep for a year, and what do you let go at 90 days?
0 replies · 1 views
Automation rules and playbooks: what do you let run without a person?
0 replies · 1 views
Ingestion cost: how do you keep the bill from surprising you?
0 replies · 1 views
Entity behavior: has UEBA told you something the alerts did not?
0 replies · 1 views
Workbooks: do you still build them, or has XDR replaced them?
0 replies · 1 views
Data connectors: what did you connect and then wish you had not?
0 replies · 1 views
Attack surface reduction rules: which ones did you turn on, and which ones broke something?
0 replies · 2 views
KQL in Sentinel: the query you keep pinned
0 replies · 2 views
Defender exclusions you added and later regretted
0 replies · 5 views
Conditional Access: the policy that bit you
0 replies · 5 views
Onboarding devices to Defender for Endpoint: what failed the first time?
0 replies · 2 views