Alex Verboon

🛡️The Defender Resource Hub Fall 2025 Update is here! defenderresourcehub.info New content from Microsoft, MVPs & the community. blogs, tools & references all in one place. #Defender #Security #MicrosoftSecurity #DefenderXDR #MicrosoftSentinel #mvpbuzz #DefenderResourceHub

Just released my first community tool in public preview 🎉 EAM‑AutoUpdater helps automate Intune EAM app updates & reduce manual effort. Try it & share feedback 👇 github.com/JanicVerboon/E… #Intune #EnterpriseApplicationManagement #PowerShell

Join me at KustoCon 2026 (In-person Zürich) meetu.ps/e/PXs8t/C6MQs/i #KQL

Check out my blog post "Mastering (Orphan) API Connections in Microsoft Sentinel Playbooks" in which I demonstrate how to manage the API connections of your Microsoft Sentinel Playbooks and identify orphaned ones. blog.ambrozzo.ch/posts/masterin… #microsoftsentinel #LogicApps #IaC

Intune 2603 finally fixes RBAC scope tag pain with Scoped Permissions. I took a deep dive into how it works & which real‑world problems it solves 👇 @verboonjanic/a-deep-dive-into-the-new-intune-scoped-rbac-permissions-3ffb6a9cee74" target="_blank" rel="nofollow noopener">medium.com/@verboonjanic/…

Unified Tenant Management with Nik Charlebois-Laprade - RunAsRadio runasradio.com/Shows/Show/1029

NEW BLOG: [DxBP] Part 1 - Technical Detection Engineering Best Practices 🔗 Link: tr.com/posts/dxbp-par… Part 1 covers: 🔹Ingestion delays 🔹How to handle different system languages 🔹Why case sensitivity matters 🔹Best practices for using join And more best practices.

Three ways to run KQL on Microsoft Sentinel data lake: Interactive, Async, or Jobs | Microsoft Community Hub techcommunity.microsoft.com/blog/microsoft…

@_0b1d1 PDF please 🙏

Introducing a comprehensive SOC Incident Response Playbook a fully structured, 100+ page collection of real world runbooks built for modern security operations teams.

[New Blogpost] - Modern Security for Legacy Systems - Defender for Endpoint on Windows 7 #DefenderXDR #DefenderforEndpoint #Windows7 medium.com/p/modern-secur…

New blog post on Defender for Identity’s new Automatic Windows Event Auditing Configuration a powerful feature that ensures your domain controllers always log the right events for optimal detection. @verboonalex/defender-for-identity-automatic-windows-event-auditing-configuration-0e7ed8e89f62" target="_blank" rel="nofollow noopener">medium.com/@verboonalex/d… #MicrosoftSecurity #DefenderForIdentity #mvpbuzz

Adopting Unified Custom Detections in Microsoft Sentinel via the Defende... youtu.be/ZB15mfUk_rU?si…

Disabling a user account during a security incident removes them from all Microsoft Teams. Private channel membership is not automatically restored. This #KQL query lists all private channels the user was removed from. github.com/lorisAmbrozzo/…

Time for your monthly dose of Kusto! Kusto Insights - October Update is out: open.substack.com/pub/kustoinsig…

In our latest TI Report, we investigate a malware campaign spreading via malicious game mods. Attackers use social engineering and the Stealit credential stealer to harvest sensitive data. Learn: basevision.ch/basevision-ti-… #CyberSecurity #Malware #SOC #Stealit #SecurityAwareness

Following my appearance on @KqlCafe today (thank you for the invite!) here's a sample query that you can use (define the filtering logic) to get a file signature's status using both DeviceFileCertificate and FileProfile() to get the most complete picture. github.com/SecurityAura/D…

KustoCon 2025 youtu.be/VQI9WgG--Xs?si… #kql #community #kustocon

Workplace Ninja Summit is loud and clear in Baden, Switzerland. Welcome to Day 2! #wpninjas #msintune #windows

Stop by the Ninja Desk at #WPNinjas and grab some high quality ninja branded swag while supplies last. Don’t miss this!

I just published Collect Microsoft Entra Connect Sync Audit Events medium.com/p/collect-micr… #EntraConnect #Entra #Audit #MicrosoftSentinel #Security