How to Use Microsoft Sentinel Watchlists to Cut False Positives
Use Sentinel watchlists to suppress known scanners, flag VIP accounts and keep exclusions out of your rule logic, with ready KQL for each pattern.
27 Oct 20268 min read
All
Alert Triage
Detection Engineering
Incident Response
Threat Intelligence
Threat Hunting
SIEM and Tools
Career and Certs
Cheat Sheets
Threat News
2 posts found
How to Run Cross Tenant Sentinel Queries in an MSP SOC
Set up Azure Lighthouse access, write workspace() queries that label every client and learn the limits of cross workspace rules before you run a multi tenant SOC on them.
9 Sep 20269 min read