Frederiek Goemaere

𝗨𝗻𝗱𝗲𝗿𝘀𝘁𝗮𝗻𝗱𝗶𝗻𝗴 𝗧𝗶𝗺𝗲 𝗗𝗶𝗳𝗳𝗲𝗿𝗲𝗻𝗰𝗲𝘀 𝗶𝗻 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗦𝗲𝗻𝘁𝗶𝗻𝗲𝗹: 𝗪𝗵𝘆 𝗜𝘁 𝗠𝗮𝘁𝘁𝗲𝗿𝘀 𝗳𝗼𝗿 𝗔𝗻𝗮𝗹𝘆𝘁𝗶𝗰𝘀 𝗥𝘂𝗹𝗲𝘀 Ever wondered why Scheduled Query Rules and Near-Real-Time (NRT) Rules in Microsoft Sentinel use different timestamps? This infographic dives into the key differences between ingestion time and time generated and why they are critical for their specific purpose. In a nutshell: ▶️ Scheduled Query Rules rely on time generated, focusing on when events actually happened, making them suitable for analyzing historical trends. ▶️ NRT Rules use ingestion time to detect events as soon as they arrive in Sentinel, ensuring fast, real-time responses. The infographic also highlights other types of timestamps, such as event time and time received, explaining their uses and how they contribute to better detection and analysis.

104

2 Comments

New Episode Alert! 🚨 Microsoft’s “Remove Default Store Apps” policy in #Windows11 25H2 doesn’t actually remove them for current users. In this episode of #PatchMeIfYouCan, Rudy Ooms digs into what really happens under the hood, why #GPO still rules, and how #PowerShell can give you the control Microsoft won’t. Listen in to learn: ➡️ What actually gets removed (hint: not much for existing users) ➡️ How the undocumented CSP hints at future #Intune support ➡️ How to extend the policy with custom PowerShell ➡️ What’s hiding in the DLLs ➡️ And why this feature might be more bark than bite Check it out here: https://lnkd.in/g9jb4cWM #ITAdminLife #AppManagement #SysAdminHumor #PatchMyPC

45

🎁 Introducing a new tool: the DLP Endpoint Manager! 🎁 ⌛ Managing DLP policies in the PPAC can be tedious - especially at scale. Lately I have been focusing on the Endpoint Filtering setup. 🤖 This is even more relevant today since this is one of the features available to govern Copilot Studio and restrict the Public and SharePoint sites that Makers can use as Knowledge Sources. 🤯 Instead of manually configuring the endpoints to allow for each connector and for each DLP policy, the Endpoint Manager lets you define the rules in one place and apply them broadly - even for custom connector patterns. 👉 Check it out: https://lnkd.in/eEYHHvyQ As always I’d love your feedback! (Yes, it's still in preview, but hey… might as well get ahead of the game 😄) #PowerPlatformGovernance #CopilotStudio

65

5 Comments

A quick (mild) rant. I just renewed my Azure Solutions Architect Expert certification. Because of course, what else would I do on a Saturday night? 26 questions — and not a single one felt like it had anything to do with architecture. To be fair, the AZ-305 training material is excellent. It truly prepares you for a real-world solutions architect (or technical architect) role — with a solid mix of technical and architectural focus. The original certification exam (via Pearson VUE) also felt relevant and well-structured. Unlike the older AZ-302/303/304 exams, AZ-305 actually seemed to get what architecture is about. But the renewal questions? Not even close. They were all about configurations, limitations, and picking the “right” option from a list — where three out of four choices were plausible, and only one matched a specific volume mentioned in the scenario. Not exactly what you’d expect from an ARCHITECT level certification. Honestly, the renewal felt more like an Azure Administrator quiz — or something you'd give a "technical assistant to a solutions architect." I think this reflects a common misconception: that an architect is simply someone who has a lot of technical details memorized. Too often, organizations treat the architect role as just a more senior engineer or developer — rather than a distinct discipline focused on designing holistic, scalable solutions.

56

9 Comments

Many years ago, Microsoft showed us their potential successor to the ASP.NET machineKey-based secret protection mechanism in a private meeting. It was still in a prototype state but fixed all the security problems of the previous (admittedly awful) approach – everyone agreed with that. This new API became what is called “ASP.NET Data Protection” today. We had a long discussion afterwards around the question if this API is easy enough to use across typical application scenarios. We concluded that this is one of the things that you cannot make “dead simple” – it is a hard problem to solve, there is bootstrapping required, and you need to understand what you are doing. Making it everyone’s problem from day one or making and it “just work” for developers and delaying the problem until deployment day is a trade-off. Microsoft decided to use the latter approach. Still today many of Duende’s support issues are not related to the product itself, but to ASP.NET Core features. Data Protection problems are clearly #1. Khalid wrote a really good summary of how Data Protection works, and what you need to know to become successful with it. https://lnkd.in/eiBfFWSw

108

1 Comment

This is why Backups Are Life. Because when something goes wrong (and it will), the only thing standing between a minor hiccup and a full-blown disaster is a solid backup strategy. ✅ Automate it. ✅ Test it. ✅ Love it. Because explaining “What’s a backup?” during a crisis is… not the superhero moment you want. If you're in need of BDR benefits and best practices, check out this blog 👉 http://ms.spr.ly/6040sEPZG #MSPLife #DataProtection #CyberSecurity #BusinessContinuity #TechHumor

53