Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Continuing our journey through Sentinel ingestion cost reduction, this part focuses on one of the most expensive log sources: firewalls, and more specifically, network traffic events. Network traffic logs from firewalls are highly voluminous and often become the largest contributor to data ingestion costs.
This is Part 3 of our Blog series on how to collect events using DCRs for advanced use cases: Part 1: The power of Data Collection Rules: Collecting events for advanced use cases in Microsoft USOP - Mic....
In my previous blog, I explained what window functions are and how we can use them for threat hunting and detection by giving Cloud Account Takeover Attacks as an example and using the prev() function: In this post, I'll explain the sliding_window_counts plugin and provide you with a query for Password Spray attack detection/hunting. According to the documentation, the sliding_window_counts plugin calculates counts and distinct count of values in a sliding window over a lookback period.
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
