WELCOME

DHS CISA SCuBA (Secure Cloud Business Applications) DHS CISA SCuBA (Secure Cloud Business Applications) is a security assessment framework and toolset developed by Cybersecurity and Infrastructure Security Agency to evaluate the security posture of cloud-based SaaS environments, primarily Microsoft 365 and similar platforms. At a technical level, SCuBA provides: Baseline security configuration checks aligned to federal guidance (e.g., logging, identity controls, sharing setti

Application log collection to Sentinel SIEM in a Microsoft defender environment Microsoft Defender for Endpoint (MDE) is a highly capable EDR platform that, when deployed to workstations and servers, collects extensive telemetry including process creation, network connections, file activity, registry changes, authentication events, and security logs. Out of the box, it provides deep endpoint visibility, functionally similar to an enhanced, enterprise-grade Sysmon. In many cas

Threat Hunt Mission Organization in SIEM/XDR Standard Operating Procedure (SOP) 1. Purpose This Standard Operating Procedure (SOP) defines the standards, steps, and required configurations for organizing and executing Threat Hunt missions within Security Information and Event Management (SIEM) and Extended Detection and Response (XDR) platforms. It establishes a consistent, repeatable methodology for structuring hunt workspaces, managing queries, capturing findings, and prod

Threat Hunt Mission Reporting SOP 1. Purpose This Standard Operating Procedure (SOP) defines the requirements, structure, and standards for producing Threat Hunt Mission Reports. A Threat Hunt Mission Report is the formal deliverable published upon the completion of every Threat Hunt mission. It provides stakeholders with a comprehensive record of the hunt objectives, methodology, findings, indicators of compromise, detection outputs, and recommendations for improving the or

Threat Hunt Mission Execution SOP 1. Purpose This Standard Operating Procedure (SOP) establishes the standardized process, roles, responsibilities, and operational expectations governing the execution phase of Cyber Threat Hunt missions. It is designed to ensure consistency, analytical rigor, and operational effectiveness across all threat hunting activities conducted by the Security Operations Center (SOC) Threat Hunt team. 2. Scope This SOP applies to all personnel particip

Threat Hunt Program Training - Standard Operating Procedure (SOP) 1. Purpose This Standard Operating Procedure (SOP) establishes the training framework for personnel assigned to the Threat Hunting program. The objective is to ensure that threat hunters develop the technical, analytical, and operational competencies required to proactively identify adversary activity within the organization’s environment. This SOP defines: Required threat hunting skill domains Training phases

Threat Hunting Frameworks Threat hunting is a proactive cybersecurity discipline that requires structure, strategy, and context. Two of the most popular threat hunting frameworks are PEAK and TaHiTI, with the MITRE ATT&CK framework playing a foundational role across all threat hunting efforts. PEAK stands for Prepare, Execute, and Act with Knowledge . TaHiTI stands for Targeted Hunting Integrating Threat Intelligence . MITRE ATT&CK, while not a hunting framework per se, is a

Threat Hunt Mission Planning - Standard Operating Procedure (SOP) 1. Purpose This Standard Operating Procedure (SOP) defines the process for planning Cyber Threat Hunting missions. Effective mission planning ensures threat hunts are conducted in a structured, repeatable, and intelligence-driven manner that maximizes both investigative quality and operational efficiency. A well-developed mission plan enables the threat hunting team to clearly define objectives, scope investiga

Threat Hunting & Cyber Threat Intelligence (CTI) - Standard Operating Procedure (SOP) 1. Purpose This Standard Operating Procedure (SOP) defines the processes for integrating Cyber Threat Intelligence (CTI) into Threat Hunting missions. The objective is to ensure threat hunting activities are informed by relevant intelligence, structured investigative methodologies, and standardized intelligence collection and analysis practices. Effective integration of CTI into threat hunti

Threat Hunt Mission Intake, Prioritization, Design, Scoping, and Targeting - Standard Operating Procedure (SOP) 1. Purpose This SOP establishes the standardized process for intaking, prioritizing, designing, scoping, and targeting Threat Hunt missions within the organization. The goal is to ensure threat hunting activities are centrally coordinated, strategically prioritized, and executed in a structured and repeatable manner that maximizes operational effectiveness and visib

Enhanced Monitoring Overview In environments using Microsoft Defender XDR and Microsoft Sentinel, there are situations where enhanced monitoring is required beyond normal security operations. This article outlines several enhanced monitoring approaches and explains the nuances associated with each. The starting point is understanding the steady-state security monitoring model in an environment where Defender XDR and Sentinel are integrated. In this architecture, detections ar

What is yara? YARA is an open-source, cross-platform tool used by malware researchers and security analysts to identify, classify, and detect malware samples based on textual or binary patterns. Often described as a "Swiss Army knife" for threat hunting, YARA operates by matching specific rules, sets of strings and Boolean conditions, against files or running processes, enabling the identification of malware families. Yara is maintained by VirusTotal. Ways yara can be implem

Rolling Aerts into Incidents - XDR A key strength of Microsoft Defender is its ability to correlate disparate alerts from various detection sources into a single, cohesive incident view. This approach enables defenders to understand an attack or compromise holistically rather than managing fragmented alerts. Microsoft Defender XDR extends this capability by continuing to unify and correlate alerts from multiple security domains, identity, endpoint, email, and cloud applicatio

Microsoft Copilot Overview Microsoft has named its Artificial intelligence (AI) product Copilot. Microsoft currently offers the following AI products. Microsoft Security Copilot is the AI product that is covered in the SC-200 exam. Copilot for Microsoft 365 : This version is designed for businesses and integrates AI into Microsoft 365 apps like Word, Excel, PowerPoint, Outlook, and OneNote. Copilot for Sales : This version helps sales teams maximize effectiveness and close

Microsoft Purview is a unified data protection and governance platform that combines legacy Microsoft security tools with new, advanced capabilities to help organizations safeguard their data. It provides a broad range of solutions, enabling multiple teams within an organization to collaborate effectively in achieving data protection, governance, and compliance. Why Microsoft Purview Stands Out Extensive Coverage – It integrates Data Governance, Data Loss Prevention (DLP), In

Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Cloud Apps (MDA) primarily focuses on discovering and assessing the applications used within your environment. It includes a risk rating system that evaluates app risk levels, enabling you to establish policies that restrict or allow the use of specific applications. MDA also monitors for suspicious app behavior. For instance, consider an app like AZCopy, a Linux-based tool for transferring data from Azure. If an

Microsoft Defender for Office365 (MDO) Think of MDO as your email security gateway, constantly scanning emails to defend against phishing, malware, and spoofing attempts. Here's how it works: Analyzing Email Sources : Evaluates the origin of emails, checking against databases of known malicious senders and infrastructure. Verifying Sender Authenticity : Confirms whether the sender's identity, brand, and domain are legitimate. For external domains, spoof intelligence ensure

Microsoft Defender for Identity (MDI) Identity Protection: Understanding and Addressing Identity-Based Threats Identity protection focuses on identifying and mitigating weaknesses and threats related to identity systems. The adage "Identity is the new perimeter" may be overused, but it accurately highlights the reality of modern cybersecurity. Threat actors target identities because they grant access to systems and sensitive information. With the growing shift to cloud-based

Demystifying the Microsoft SC-200 Certification The Microsoft SC-200 certification is designed for cybersecurity analysts and engineers who work with Microsoft's security solutions. According to Microsoft, the SC-200 course teaches professionals how to investigate, respond to, and hunt for threats using Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Defender for Cloud. Microsoft is a dominant player in the cybersecurity industry, offering a broad suite of security

Many Identity & Access Management frameworks are several years old, so care needs to be taken on what a mature 'Identity management' looked like in 2010 versus 2025. Gartner Identity & Access Management (IAM) Maturity Model One of the primary maturity models used for Identity and Access Management (IAM) is the Gartner IAM Maturity Model. This model evaluates IAM maturity using standard capability maturity levels—Initial, Developing, Defined, Managed, and Optimized, across key