Proof we're not bluffing

This tutorial demonstrates how to optimize Kusto Query Language (KQL) for Advanced Hunting in Microsoft 365 Defender so queries run faster and avoid timeouts—especially at enterprise scale. It begins with an intentionally slow join between IdentityLogonEvents and IdentityInfo, then shows how to use the execution-time and resource-usage indicator (low/medium/high) plus count to spot overly broad queries. The core guidance is to filter early—especially with time filters, since KQL is highly optimized for them—using conditions like “greater than 1 hour ago” or a bounded window with between. It then covers practical operator choices: prefer has over contains when you’re matching full tokens, use case-sensitive operators where possible (has_cs, equals vs equals~), and treat joins with care by filtering the left table first, placing the smaller table on the left, and understanding join behavior—default innerunique can de-duplicate and hide useful duplicates, so an inner join may be safer when duplicate join keys matter (like multiple attachments).

We produced this as a performance-minded training clip—designed to teach a repeatable mental model, not just a bag of tricks. The pacing intentionally shows the “before” pain, then the “after” improvement, with clean callouts for what changed and why it helped. The result is a tutorial viewers can apply immediately to their own hunts—faster results, fewer resource spikes, and a smoother path to meaningful findings. Final delivery includes closed captions, audio description, and thumbnails.

This video introduces Unified role-based access control (RBAC) in Microsoft 365 Defender—one permissions model designed to simplify access management across Defender experiences. It explains how unified RBAC helps you centralize role assignments, reduce inconsistent permissions across tools, and apply least-privilege access with clearer governance. The demo shows where unified RBAC lives in the Defender portal, how roles map to security functions, and how admins can assign and manage roles so the right people can see and do the right things—without granting everyone the keys to the entire SOC spaceship.

We produced this as a clarity-first admin explainer: the narrative focuses on the “why” (simpler governance, consistent access) while the visuals show the “where” and “how” in the portal. Postproduction keeps the pacing crisp so the concept lands quickly and viewers leave with a usable mental model. Final delivery includes closed captions, audio description, and thumbnails.

This demo explains how Microsoft 365 Defender APIs are moving to the Microsoft Graph Security API—and how you can use Graph to automate workflows and integrate your own apps with Microsoft 365 Defender. It breaks down the mechanics: apps authenticate to Microsoft Graph with OAuth 2.0, receive an access token, then call REST endpoints and exchange data as JSON. The walkthrough shows registering an app in Azure AD (App registrations), choosing delegated vs application permissions (daemon/background service vs signed-in user), and applying least-privilege access—using “Read all incidents” as the example—plus the critical step of granting admin consent. It then creates a client secret, grabs the application (client) ID and directory (tenant) ID, and uses a PowerShell example to query incidents updated in the last 48 hours via the Graph endpoint (security/incidents), noting API versioning (v1.0 for production, beta for prerelease). Finally, it submits the request with headers, parses the JSON response, and exports the incident results to a uniquely named JSON file.

We produced this as a clean, developer-friendly demo built to remove friction from a workflow that’s usually…let’s call it “documentation-adjacent.” In preproduction we mapped the exact setup and the minimum set of steps that actually matter (permissions, consent, secret, IDs), then in production we captured crisp screens and recorded pro voiceover that keeps the pace steady without skipping the gotchas. In post, we shaped it into a tight, follow-along walkthrough—so viewers can implement the integration quickly, avoid common missteps, and walk away with a repeatable pattern they can expand beyond “read incidents” into real automation. Final delivery includes closed captions, audio description, and thumbnails.

This demo shows how Microsoft Sentinel and Microsoft 365 Defender work better together—specifically, how Defender incidents can be brought into Sentinel so analysts can investigate and respond from a single SIEM queue. It walks through enabling the Microsoft 365 Defender connector in Sentinel, connecting incidents and alerts, and confirming that the data is flowing correctly. The video also highlights why this integration matters: Sentinel gains richer incident context from Defender (alerts, entities, and timelines), and incident updates stay synchronized across both portals so assignments, status changes, and closures don’t drift out of alignment.

We produced this as an integration walkthrough designed for speed and certainty. The script is built around the critical decisions (what to enable, what to avoid to prevent duplicates, how to verify), the visuals stay tight on the connector configuration, and the edit keeps the flow practical so viewers can replicate it without guesswork. Final delivery includes closed captions, audio description, and thumbnails.

This overview introduces Microsoft 365 Defender as an integrated, cross-domain threat detection and response solution built for attacks that move across endpoints, identities, email, apps, and data. It frames the problem as signal overload and siloed tools—alert fatigue, isolated domain views, and slow, fragmented response—then explains how Defender normalizes and correlates raw signals into incidents with full context. The video calls out automated correlation across domains, unified incident timelines and impacted assets (like devices, identities, and mailboxes), and coordinated remediation that tackles both the obvious damage and persistence—plus the option for teams to customize workflows and sensitivity once they’re ready.

We produced this as a narrative-driven platform story: crisp voiceover, clean visuals, and an edit designed to make a big concept feel simple without oversimplifying. The structure is intentional—problem, consequence, solution, outcome—so prospective customers can “get it” quickly and remember the why. Delivered with closed captions, audio description, and thumbnails.

This demo introduces Microsoft Secure Score as a measurable way to understand—and improve—your security posture across Microsoft 365. It shows how your score is calculated from recommended actions, how points are earned as you complete improvements, and how the experience helps you prioritize work by impact. The video highlights browsing improvement actions, reviewing action details (what the control does, how to implement it, what products it touches), and using Secure Score as an ongoing program tool—not a one-time “report card”—so teams can track progress over time, compare posture, and focus on the changes that meaningfully reduce risk.

We produced this as a clear, executive-friendly walkthrough that still gives practitioners enough detail to act. In preproduction we shaped the narrative around “measure→prioritize→improve,” in production we captured clean UI with steady voiceover, and in post we tightened the flow so the takeaways land quickly: what Secure Score is, how to use it, and how to turn recommendations into real security wins. Final delivery includes closed captions, audio description, and thumbnails.

This video lays out an operational rhythm for running Microsoft Defender for Office 365 like a well-tuned SOC machine: daily, weekly, monthly, and ad hoc tasks. Daily, it starts with monitoring the Incidents queue in Microsoft 365 Defender and triaging medium/high severity incidents—prioritizing potentially malicious URL clicks, restricted senders, suspicious sending patterns, user-reported phish/malware, messages removed after delivery, phish delivered via policy override, and cases where email wasn’t zapped because ZAP was disabled. It then covers daily hygiene: submit false positives/negatives to Microsoft, review admin submission results, use the tenant allow-block list for false negatives, release false positives from quarantine when confirmed, investigate delivered false negatives with Explorer, and review Campaigns targeting your org—especially anything that reached recipients. Weekly, it recommends reviewing detection trends in reports (Mailflow and Threat protection status), using Threat analytics to track emerging threats (IoCs, hunting queries, techniques, vulnerabilities), reviewing Top targeted users in Threat Explorer and considering priority account tagging, and checking top malware/phishing campaigns. Monthly, it suggests policy review, auditing detection overrides via the Threat protection status report, and tuning spoof/impersonation using Spoof Intelligence Insight and Impersonation Detection Insight. Ad hoc, it highlights investigating/removing bad email in Threat Explorer, proactive hunting with Threat Explorer and Advanced Hunting (including shared queries and custom detections), and keeping priority accounts current.

We produced this as an “ops playbook on rails”—structured so teams can adopt the cadence immediately, not just nod thoughtfully and forget by lunch. Preproduction focused on sequencing (what to do first, what to do routinely, what to do when needed), production captured the key Defender views with professional voiceover, and post kept it tight so the checklist feels doable rather than…aspirational. The payoff is a demo that helps organizations reduce reactive churn, spot patterns sooner, and keep Defender for Office 365 running with fewer surprises and more control—delivered with closed captions, audio description, and thumbnails.

This tutorial introduces Kusto Query Language (KQL) fundamentals for Advanced Hunting in Microsoft 365 Defender. It starts with the “shape” of a query—select a table, then refine results using the pipe operator—and demonstrates common building blocks like where filters, projecting specific columns, sorting with order by, limiting results with take, and using summarize to aggregate counts. It also covers practical hunting habits: starting broad to explore, then narrowing by time window and key fields to answer a specific investigation question.

We produced this as a friendly on-ramp—paced to teach the essentials without turning it into a syntax marathon. The screen capture stays focused on the query editor and results grid so viewers can connect each line of KQL to the data it produces, and the edit is structured as small wins that build confidence. Final delivery includes closed captions, audio description, and thumbnails.

This overview explains how Microsoft 365 Defender turns siloed, high-volume security signals into cross-domain incidents that are easier to prioritize and resolve. It walks through the Incidents queue, then opens an incident and tours the key tabs: Summary (alert counts, active vs resolved, MITRE ATT&CK mapping, originating products, affected assets like devices/users/mailboxes/apps, top impacted entities, evidence and remediation status, plus metadata like tags and user groups), Alerts (severity, status, and why each alert is linked—often auto-investigated and resolved), Devices (risk level and tags with drill-down), Users (including investigation priority from UEBA), Mailboxes (with pivots into Explorer), Apps (with pivots into Defender for Cloud Apps), Investigations (automation status and remediation actions), and Evidence and Response (counts by entity type—emails, files, URLs—plus drill-down to item details). It also demonstrates “Go hunt,” which launches an Advanced Hunting query from an evidence item to expand scope, and finishes with the incident graph—a visual map of related entities with options to view details, pin/hide alerts, and sometimes take actions directly—before resolving the incident via Manage incident and classifying it (true positive multistage attack in the example).

We produced this as a guided tour that keeps the experience coherent even though the incident itself is gloriously complex. The narration is structured to match the investigation flow and the edit keeps momentum while still letting each tab’s purpose register. The payoff is a video that helps teams feel confident in the incident workspace—and faster at turning context into action. Final delivery includes closed captions, audio description, and thumbnails.

This demo shows Guided hunting in Microsoft 365 Defender—a visual query builder for Advanced hunting that doesn’t require KQL or schema knowledge. It compares the two modes (Query in editor vs Query in builder), then builds a phishing-focused hunt by filtering delivered messages using ThreatTypes (phish, malware, spam) and DeliveryLocation (inbox and junk). From there it expands the query by selecting a suspicious SenderMailfromDomain value directly from results, adding it as a filter, and layering in UrlCount > 0 to focus on messages containing links. The walkthrough also covers quality-of-life features: customizing displayed columns without KQL project, opening entity details via linked fields like NetworkMessageId, taking action on results from within Advanced hunting, and using Edit in KQL to reveal the generated query as a learning path.

We produced this as an approachable, confidence-building tutorial—built to make “advanced hunting” feel accessible to any analyst. We choreographed the on-screen steps to match how people actually explore data (filter, inspect, refine), kept the visuals uncluttered, and tuned the pacing so viewers can follow along live. Final delivery includes closed captions, audio description, and thumbnails.

This tutorial demonstrates how to join tables in KQL for Advanced Hunting so you can enrich one dataset with context from another. It explains why joins matter (threat signals are spread across different tables), then walks through join types and patterns—matching on shared keys, choosing inner vs leftouter depending on whether you want to keep unmatched rows, and reducing performance cost by filtering early. The demo shows how to use join to connect related events (like device activity with URL clicks, file activity, or identity context), then clean up the output with project to keep only the columns you need.

We produced this as a hands-on KQL technique lesson: the visuals stay close on the query edits and results so viewers can see enrichment happen in real time, and the pacing slows at the “this join type changes your result set” moments so the concept sticks. Final delivery includes closed captions, audio description, and thumbnails.

This video explains why incident classification is a core SOC habit in Microsoft 365 Defender—and how to do it quickly while triaging the incident queue. It breaks down true positives vs false positives and highlights a third option: informational/expected activity (like security testing), which helps avoid tuning detections the wrong way. The demo then shows the exact workflow: from the incident queue, open an incident side pane, select Manage incident, choose a determination (true-positive, informational, or false-positive), and add a comment to document the decision. It also covers how incident classification flows down to unclassified alerts automatically, and how to classify alerts individually via the alerts queue using Manage alert when you need more granularity.

We produced this as a workflow-first explainer—the kind that helps teams adopt a repeatable habit, not just understand a concept. We shaped the narrative around real triage pressure, captured the precise UI steps with clear callouts, and polished the edit so the process feels fast and doable. Final delivery includes closed captions, audio description, and thumbnails.