Tag
4 articles connected to this technical signal.
A production runbook for quarantining a suspicious Azure DevOps self-hosted agent, preserving evidence, bounding exposed identities and validating a clean replacement before the pool receives production jobs again.
Read articleA production runbook for proving watchlist freshness, schema, SearchKey, deletions and KQL behavior before allowing it to influence automated response.
Read articleA production runbook for separating source ingestion, latency, analytics-rule execution, KQL windows and incident creation before changing a Microsoft Sentinel detection.
Read articleA production runbook for bounding a Microsoft Sentinel playbook across trigger, entities, identity, dry run, approval, traces, canary and rollback before any remediation action.
Read article