Making Security SIEMlessly Simple
Live Last read · last published · next check
An ocean of logs. A canvas of clues. For many, cybersecurity is simply data. But perhaps it isn't all about reading logs. Perhaps it's more like standing in front of a piece of abstract art. At first, the canvas appears chaotic. Colours seem disconnected. Brushstrokes feel
A tour of a small software studio of about twenty AI staff running on a single Mac Studio in the corner. Who sits where, how the work actually flows, and what we've shipped.
The VS Code extension that used to be SentinelCodeGuard shipped its biggest release: coverage of every Sentinel content type, first-class Defender XDR authoring, and a connector catalogue rebuilt from Microsoft's own source data.
Sentinel-As-Code 26.07 renders the Documenter's daily Markdown inventory into a styled Word (.docx) report: numbered table of contents, colour-coded severity tables, and 42 gap-analysis rules across MITRE ATT&CK, cost, and hygiene. Here's what's in it, and what the same day's other pushes mean.
Nobody likes writing documentation. Even when you do write it, it starts dying the moment you save the file. Someone tweaks a setting in the portal, swaps a connector, changes a detection rule, and your carefully written workspace document is quietly drifting out of date for whoever reads it next.
Wave 2 closed with one specific promise: end-to-end Pester tests wired in as a PR gate, with branch protection on main so nothing merged without a green run. Wave 3 lands that gate, plus a handful of other things that took shape alongside it. The
About a year ago I published Automating Microsoft Sentinel Deployment , a three-stage pipeline that provisioned infrastructure via Bicep and deployed Content Hub solutions through a single PowerShell script. It worked, but it was limited. Last month I released Wave 1 of the 2026 rebuild , a ground-up
One Script to rule them all, One Script to find them, One Script to bring them all, and in the SOC bind them. If you have ever tried to move a Microsoft Sentinel playbook from one tenant to another or from the portal into a Git repository you will
Deploy Your Entire Sentinel Environment from a Single Repo When I first pushed Sentinel-As-Code to GitHub in March 2025 with the subsiquent blo g, it was a straightforward Bicep deployment tool — a couple of templates to stand up a Log Analytics workspace and onboard Sentinel. Useful, but
Sometimes the hardest thing isn't what you're going through it's admitting you need help. There's no easy way to start this post. I've written and rewritten this several times now, trying to find the right words. But I think that&
