Uncategorized

Azure DDoS IP Protection

Last week during Ignite 2022, Microsoft released a public preview of a new DDoS feature called IP-based protection which is aimed at protecting DDoS attacks on layer 4 (namely TCP SYN Flood attacks) When looking at the statistics for Q3 this year from the blog from Cloudflare, the most predominant form of DDoS attacks is …

Azure DDoS IP Protection Read More »

Deployment of Azure Container Apps with Volume Mounts using Terraform

Recently with working with a customer, we wanted to set up Azure Container Apps with Volume Mounts using CI/CD with Terraform. Until now, the only option has been to configure it using Azure CLI. However! last week Microsoft introduced some new part of the API that allows us to manage this using Azure Resource Manager …

Deployment of Azure Container Apps with Volume Mounts using Terraform Read More »

Microsoft Defender falsely detecting Win32/Hive.ZY

Just a quick post, after a recent signature update to Microsoft Defender (This one –> Antimalware updates change log – Microsoft Security Intelligence)  you might get these events from Defender. This was a false positive and has been fixed in the latest signature updates from Microsoft Antimalware updates change log – Microsoft Security Intelligence (1.373.1537.0)

Getting started with Microsoft Defender EASM (External Attack Surface Management)

About a week ago, Microsoft released a new product called Microsoft Defender EASM which is based upon an earlier product from RiskIQ and is now a part of Microsoft Azure. You can look at this as a Shodan-light alternative where you can see your organization from an outside view—looking at what kind of external services …

Getting started with Microsoft Defender EASM (External Attack Surface Management) Read More »

Citrix (CVAD) vs Azure Virtual Desktop – Part One

A long time ago I wrote a blog post around Microsoft RDS vs Citrix XenDesktop at the time where I looked at the overall functionality and end-user experience, which you can read about here  https://msandbu.org/so-why-choose-citrix-over-microsoft-rds-2/ (and now fast forward to 2022 not much of that is that much relevant anymore.) A Couple of weeks ago I saw …

Citrix (CVAD) vs Azure Virtual Desktop – Part One Read More »

Streaming of audit logs from Oracle Cloud to Microsoft Sentinel

With the recent announcement of a new partnership between Microsoft and Oracle for Oracle database services, I wanted to look further into setting up log collection from Oracle Cloud to Microsoft Sentinel. When I started digging there wasn’t much information available (except some minor blog posts from the Oracle side, but I wanted to use …

Streaming of audit logs from Oracle Cloud to Microsoft Sentinel Read More »

Cross Analytics queries with a multitenant Azure Sentinel setup

I was currently in a project where we needed to have a multi-tenant Microsoft Sentinel environment. We had multiple Sentinel / Log Analytics workspaces where we needed to do cross queries to look at the datasets which is typically the case with MSSP environments. When it comes to using Microsoft Sentinel as a multi-tenant solution such as …

Cross Analytics queries with a multitenant Azure Sentinel setup Read More »

Scroll to Top