by Jesper Kråkhede, Sweden
Posted in Security Architecture, Technology on Mar 11th, 2026
Microsoft has announced that Sentinel is moving fully into the Defender portal, and that the Azure portal experience will be retired. For many SOCs, that is a bigger change than it sounds. For years, many SOC teams have worked in two places. Defender for the endpoint, identity, email and cloud app incidents, and Sentinel in […]
Posted in Business, Security Architecture on Jul 30th, 2025
This month Microsoft introduced a data lake for Sentinel, meant to store large amounts of security data at a much lower cost than before. That may sound like a technical detail, but it touches a business question I have written about many times: how much security data can you afford to keep? For years the […]
Posted in Security Architecture, Security metrics, Technology on Mar 3rd, 2023
I have been asked many times which network logs are worth putting into a SIEM. After many incidents, here is my short list, together with what Microsoft recommends for Sentinel. The useful ones. Logs from the internet edge, especially outbound connections and what was denied. They show command and control traffic and data leaving. DNS […]