Evidence search
Search
Search titles, summaries, topics, providers, authors, and the full open-access corpus.
Results for “SIEM”
6 publicationsMove Microsoft Sentinel to the Defender portal without breaking automation
Onboarding a Sentinel workspace to the Defender portal changes incident providers, grouping, fields and automation timing with no documented error. Inventory what depends on them, rehearse safely and cut over before March 31, 2027.
Detection & response · Microsoft Sentinel / Microsoft Defender · By Cloud Security DeskMap cloud incident response to NIST SP 800-61 Revision 3
Revision 3 turned NIST's incident handling guide into a CSF 2.0 profile. Translate its rows into provider contracts, cloud evidence, containment authority and recovery ownership, and fix the log defaults first.
Detection & response · NIST / Amazon Web Services / Microsoft Azure / Google Cloud · By Cloud Security DeskInvestigate a CI supply chain compromise from workflow logs to rotated secrets
When an action or package in your pipeline turns out to be malicious, scope the response by exposure window and by what each affected job could reach, then revoke together and hunt for use.
Detection & response · GitHub / AWS / npm · By Cloud Security DeskMove cloud logs to cheaper tiers without losing detection coverage
CloudWatch Infrequent Access, the Sentinel data lake and Cloud Logging exclusions all cut ingestion cost by removing real-time detection hooks. Place each source by the rules that read it, then prove the replacements fire.
Detection & response · AWS / Microsoft Azure / Google Cloud · By Cloud Security DeskTesting Sigma detections before a backend change
Keep rule structure, field transformations, query conversion and event matching as separate checks when changing a Sigma detection backend.
Detection & response · SigmaHQ · By Cloud Security DeskCloud logs that never reach the SIEM
A dashboard can be healthy while the evidence behind it is incomplete. Coverage needs to be tested from event creation to searchable record.
Detection & response · AWS / Azure / Google Cloud · By Umair Akbar and Ahmed Elshekh