Introduction: The release of EntraOps v0.5 marks a pivotal shift in identity security, moving from reactive monitoring to proactive, AI-driven threat exposure management. This open-source framework leverages Large Language Models (LLMs) to analyze your Microsoft Entra ID environment, automating the discovery of misconfigurations and dangerous privilege accumulations that traditional tools miss. By treating identity configurations as code, it enables security teams to visualize the exact attack paths an adversary could exploit, transforming raw identity data into actionable, prioritized intelligence.

This link will take you to a page that’s not on LinkedIn

Cet article est issu du dépôt GitHub Cloud-Architekt/AzurePrivilegedIAM, un projet open source dédié à la gestion des identités et accès privilégiés dans Microsoft Azure et Microsoft Entra. Le projet EntraOps fournit une approche d'automatisation de la classification des rôles et permissions Entra ID selon le modèle Enterprise Access Model (EAM) de Microsoft.

Introduction: Microsoft Defender XDR's new `GraphAPIAuditEvents` table enables advanced hunting for suspicious Microsoft Graph API activities. Security architect Thomas Naunheim’s experimental KQL function enriches this data with EntraOps and Exposure Management insights, helping identify high-risk API calls. This article breaks down the methodology and provides actionable KQL snippets to bolster your threat detection. Learning Objectives: Learn how to leverage KQL to detect sensitive Graph API calls.

Introduction Kusto Query Language (KQL) is a powerful tool for analyzing security data in Microsoft Defender and Entra ID. In this article, we explore advanced KQL functions and hunting queries to classify and monitor privileged identities, aligning with the Enterprise Access Model for tiered administration. Learning Objectives Learn how to classify Entra ID privileges using KQL functions. Automate identity governance with the EntraOps community project.

Community project to classify, identify and protect your privileges based on Enterprise Access Model (EAM)

Sharing my KQL queries for Azure Sentinel. Contribute to Cloud-Architekt/AzureSentinel development by creating an account on GitHub.