https://naved124.github.io/tags/sentinel/Recent content in sentinel on naved // security notesHugoen-USSun, 08 Nov 2026 00:00:00 +0000https://naved124.github.io/notes/building-sentinel-detections/Sun, 08 Nov 2026 00:00:00 +0000https://naved124.github.io/notes/building-sentinel-detections/<h2 id="the-idea-in-one-paragraph">The idea in one paragraph</h2> <p>A detection rule is a claim: &ldquo;if this attack happens, I will fire, and if it doesn&rsquo;t, I&rsquo;ll stay quiet.&rdquo; Most rules never get checked against either half of that claim until a real incident or a flood of false positives does it for you. <a href="https://github.com/Naved124/sentinel-detections">sentinel-detections</a> is fifteen Microsoft Sentinel analytics rules written in KQL, where every rule ships with test cases for both halves: attack data it must alert on, and the closest normal behaviour it must ignore. Every rule also has a triage playbook, because an alert nobody knows how to investigate is just noise with a severity label.</p>