TimeGenerated asc

A guide to using Microsoft Sentinel for monitoring the security of your containerized applications and orchestration platforms.

In my previous blog, I explained what window functions are and how we can use them for threat hunting and detection by giving Cloud Account Takeover Attacks as an example and using the prev() function: In this post, I'll explain the sliding_window_counts plugin and provide you with a query for Password Spray attack detection/hunting. According to the documentation, the sliding_window_counts plugin calculates counts and distinct count of values in a sliding window over a lookback period.

How to detect, investigate and prevent blob-hunting Why is it important to understand blob-hunting? 1. Exfiltrating sensitive information from misconfigured resources is one of the top 3 cloud storage services* threats, and threat actors are continuously hunting storage objects because it’s easy, cheap, and there’s much to find. In some cases, they target your storage accounts. 2. Most people think they don’t have misconfigured storage resources. Most people do.