Posts, a podcast and video series about Microsoft Azure by Marcos Nogueira.https://azurecentric.com/https://azurecentric.com/posts/plan-access-separation-between-security-operations-teams/https://azurecentric.com/posts/plan-access-separation-between-security-operations-teams/Separate security and operations access in Microsoft Sentinel using resource-context RBAC and table-level RBAC.Wed, 23 Sep 2026 00:00:00 GMTsiem-xdrmicrosoft-sentinelrbacsecurity-operationsazure-monitorlog-analyticshttps://azurecentric.com/posts/review-connector-health-and-ingestion-changes-together/https://azurecentric.com/posts/review-connector-health-and-ingestion-changes-together/Monitor Microsoft Sentinel data connectors by combining the SentinelHealth table with the Data collection health workbook to detect ingestion drifts and configure alerts.Sat, 01 Aug 2026 00:00:00 GMTsiem-xdrmicrosoft-sentinelalertsdata-connectorsmonitoringkqlhttps://azurecentric.com/posts/check-entity-mapping-when-related-alerts-remain-separate/https://azurecentric.com/posts/check-entity-mapping-when-related-alerts-remain-separate/Troubleshoot why related alerts remain separate in Microsoft Sentinel by checking entity mapping identifiers.Mon, 08 Jun 2026 00:00:00 GMTsiem-xdrmicrosoft-sentinelalertsentity-mappingtroubleshootingincident-correlationhttps://azurecentric.com/posts/build-an-incident-triage-workbook-for-the-operations-team/https://azurecentric.com/posts/build-an-incident-triage-workbook-for-the-operations-team/Build a Microsoft Sentinel incident triage workbook using the workbook editor and gallery template export.Mon, 13 Apr 2026 00:00:00 GMTsiem-xdrmicrosoft-sentinelincident-triagekqlhttps://azurecentric.com/posts/choose-a-detection-exclusion-or-a-rule-change/https://azurecentric.com/posts/choose-a-detection-exclusion-or-a-rule-change/Decide whether to exclude entities or adjust rule logic in Microsoft Sentinel to reduce false positives.Mon, 16 Feb 2026 00:00:00 GMTsiem-xdrmicrosoft-sentinelanalytics-rulesdetection-tuningfalse-positiveskqlhttps://azurecentric.com/posts/use-advanced-hunting-to-test-a-defender-xdr-hypothesis/https://azurecentric.com/posts/use-advanced-hunting-to-test-a-defender-xdr-hypothesis/Use Defender XDR Advanced Hunting to test a threat hypothesis with KQL, then validate findings before creating detection rules.Thu, 25 Dec 2025 00:00:00 GMTsiem-xdrmicrosoft-defender-xdradvanced-huntingkqlmicrosoft-sentinelthreat-huntinghttps://azurecentric.com/posts/connect-sentinel-incidents-with-defender-xdr-context/https://azurecentric.com/posts/connect-sentinel-incidents-with-defender-xdr-context/Connect Defender XDR incidents to Sentinel: enable the connector, manage sync limits, and migrate automation rules.Sun, 02 Nov 2025 00:00:00 GMTsiem-xdrmicrosoft-defender-xdrmicrosoft-sentinelmigrationkqlhttps://azurecentric.com/posts/investigate-a-rule-that-creates-too-many-incidents/https://azurecentric.com/posts/investigate-a-rule-that-creates-too-many-incidents/Reduce Sentinel incident volume by checking rule insights, applying tuning exclusions, and verifying with simulation and reruns.Tue, 09 Sep 2025 00:00:00 GMTsiem-xdrmicrosoft-sentineltroubleshootinganalytics-rulestuninghttps://azurecentric.com/posts/use-content-hub-templates-with-a-production-review/https://azurecentric.com/posts/use-content-hub-templates-with-a-production-review/Deploy Microsoft Sentinel Content Hub solutions with a production review to validate dependencies and configuration before activation.Fri, 18 Jul 2025 00:00:00 GMTsiem-xdrmicrosoft-sentinelcontent-hubconfigurationhttps://azurecentric.com/posts/decide-which-response-steps-belong-in-a-playbook/https://azurecentric.com/posts/decide-which-response-steps-belong-in-a-playbook/Decide which response steps belong in a playbook by distinguishing enrichment, orchestration, and response actions.Fri, 23 May 2025 00:00:00 GMTsiem-xdrmicrosoft-sentinelautomationplaybooksazure-logic-appshttps://azurecentric.com/posts/build-an-automation-rule-with-a-clear-owner/https://azurecentric.com/posts/build-an-automation-rule-with-a-clear-owner/Create Microsoft Sentinel automation rules with clear scope, triggers, and verification steps.Fri, 28 Mar 2025 00:00:00 GMTsiem-xdrmicrosoft-sentinelautomation-ruleshttps://azurecentric.com/posts/use-a-watchlist-to-enrich-a-detection-query/https://azurecentric.com/posts/use-a-watchlist-to-enrich-a-detection-query/Create and use Microsoft Sentinel watchlists to enrich KQL detection queries with reference data.Tue, 28 Jan 2025 00:00:00 GMTsiem-xdrmicrosoft-sentinelkqlwatchlistshttps://azurecentric.com/posts/choose-retention-settings-around-investigation-needs/https://azurecentric.com/posts/choose-retention-settings-around-investigation-needs/Configure Log Analytics retention to balance investigation depth and cost using interactive and long-term periods.Fri, 06 Dec 2024 00:00:00 GMTsiem-xdrdata-retentionmicrosoft-sentinellog-analyticsazure-monitorcost-managementhttps://azurecentric.com/posts/map-entities-so-incidents-contain-useful-context/https://azurecentric.com/posts/map-entities-so-incidents-contain-useful-context/Map data fields to entities in Microsoft Sentinel analytics rules to enrich incidents with context for investigation.Sun, 06 Oct 2024 00:00:00 GMTsiem-xdrmicrosoft-sentinelentity-mappingkqlhttps://azurecentric.com/posts/troubleshoot-a-sentinel-connector-that-stopped-sending-data/https://azurecentric.com/posts/troubleshoot-a-sentinel-connector-that-stopped-sending-data/Troubleshoot a Microsoft Sentinel data connector that has stopped sending data using health monitoring.Sun, 11 Aug 2024 00:00:00 GMTsiem-xdrmicrosoft-sentineltroubleshootingalertshttps://azurecentric.com/posts/turn-a-detection-requirement-into-an-analytics-rule/https://azurecentric.com/posts/turn-a-detection-requirement-into-an-analytics-rule/Create a Microsoft Sentinel scheduled analytics rule from a template, verifying data sources and preview status.Tue, 18 Jun 2024 00:00:00 GMTsiem-xdrmicrosoft-sentinelanalytics-rulesthreat-detectionthreat-intelligencekqlhttps://azurecentric.com/posts/create-a-useful-kql-query-for-an-initial-investigation/https://azurecentric.com/posts/create-a-useful-kql-query-for-an-initial-investigation/Construct a focused KQL query for initial threat investigation using union, where, and project operators.Fri, 26 Apr 2024 00:00:00 GMTsiem-xdrmicrosoft-sentinelkqlthreat-investigationmicrosoft-defender-xdrhttps://azurecentric.com/posts/connect-windows-security-events-using-azure-monitor-agent/https://azurecentric.com/posts/connect-windows-security-events-using-azure-monitor-agent/Use the Windows Security Events via AMA connector to scope collection rules, select events and verify recent SecurityEvent records in Microsoft Sentinel.Tue, 27 Feb 2024 00:00:00 GMTsiem-xdrmicrosoft-sentinelazure-monitor-agentazure-monitorwindows-securitytroubleshootingdata-collection-ruleshttps://azurecentric.com/posts/plan-a-sentinel-workspace-before-connecting-data/https://azurecentric.com/posts/plan-a-sentinel-workspace-before-connecting-data/Use tenant boundaries, data residency, analyst access and ingestion needs to decide where Microsoft Sentinel data belongs before enabling connectors.Mon, 08 Jan 2024 00:00:00 GMTsiem-xdrmicrosoft-sentinellog-analytics