How to Run Cross Tenant Sentinel Queries in an MSP SOC
Set up Azure Lighthouse access, write workspace() queries that label every client and learn the limits of cross workspace rules before you run a multi tenant SOC on them.
9 Sep 20269 min read
Home / Blog
The blog
Walkthroughs, detection notes and quick references. Filter by topic or search for a technique, tool or event ID.
All
Alert Triage
Detection Engineering
Incident Response
Threat Intelligence
Threat Hunting
SIEM and Tools
Career and Certs
Cheat Sheets
Threat News
20 posts found
How to Triage a Suspicious OAuth App Consent Alert in Entra ID
Work out what a user consented to, whether the app has touched any data and how to remove it safely, with KQL for Entra audit, sign in and Graph activity logs.
14 Jul 202610 min read