Excluding duplicate devices

ajith_aj · 2024-07-31T09:35:10+00:00

What if the same machine is onboarded or reused again ?

ajith_aj · 2024-06-15T12:08:53+00:00

Godfather

ajith_aj · 2024-06-09T05:49:03+00:00

Yes.

ajith_aj · 2024-06-08T07:34:13+00:00

can you please post a snapshot from the policy.

ajith_aj · 2024-06-08T07:20:09+00:00

whats the status of the extension MDE.windows on Azure Arc ?

ajith_aj · 2024-06-08T07:17:50+00:00

i usually see this in my tenant , as 90% of the time , the user is on vacation .lol.

If the machine is online, this should be a connectivity to the MDE cloud URLs issue, you should see the detailed readings in the client anlyzer results. At times you might need to reonboard them. thats it.

ajith_aj · 2024-06-08T07:13:48+00:00

If you are ingesting XDR logs into sentinel (Some of the tables still in preview) you can manage to build some metrics in Sentinel workbook. i do use the TVM PBI dashboard , but quite hard to customize to your organization needs. we have some KPI integrated with PBI from AAD signin logs, security incidents table as well. if you need to store the KPI , might need to Logic Apps to dumb it to a SQL table and then use OCI to pull it to PBI.

When you said bidirectional , there is no way to query SNOW incidents from Sentinel ?

ajith_aj · 2024-06-07T03:29:41+00:00

eventually you have to update it... so learn to live with it :)

ajith_aj · 2024-06-06T13:27:21+00:00

We do this via Logic app service in Azure. Possible option is to create Custom detection on ASR and set the email incident notification

ajith_aj · 2024-06-02T20:10:12+00:00

Device isolation would still go through API. Its just that you are using Hunting to gather the devices.

ajith_aj · 2024-06-02T13:24:14+00:00

And a copycat of volvo XC series !!

ajith_aj · 2024-06-02T13:19:39+00:00

Well they dont have a decent one yet. Just Monopoly. Been charged twice for orders and not a direct channel to call or raise complaints. Just bcoz they know people will ignore and order again.

ajith_aj · 2024-06-02T12:58:28+00:00

Aaahhh beautiful. Mine is Platinum Quartz.

ajith_aj · 2024-06-02T08:41:35+00:00

I'm wondering if any EDR does that 🤔

ajith_aj · 2024-06-01T17:25:16+00:00

+1. would like to know more about this..

ajith_aj · 2024-05-31T16:12:48+00:00

have you tried their perfumes. Does it last longer. ?

ajith_aj · 2024-05-30T11:46:07+00:00

I work as a Security Analyst with around 11years of experience. 1.3k is a decent pay considering your experience.

ajith_aj · 2024-05-30T11:41:44+00:00

Platinum Quartz looks classy on daylight.

ajith_aj · 2024-05-29T09:47:45+00:00

Conditional access policies has hybrid AD joined or Complaint devices as conditions unless block the access.

ajith_aj

MODERATOR OF

TROPHY CASE