@jsecurity101 is next @SANSDefense ! Once upon a Login! Understanding logon sessions to add more context to your detection strategy 🎉🔥 The logon process structure and some of the logon context switch that we need to understand during investigations 🚀🏹 A Logon Session centric data approach ! Save time! Accurate!

@DrAzureAD Trying to get Nestor to skip his talk 🤣 🤣🤣🍻 @ManuelBerrueta where are you? @DrAzureAD @ManuelBerrueta Let’s go! Currently around 235 commands in AADinternals module 📝

@tifkin_ Hermanooo 😊 @Cyb3rPandaH and I were talking about some of those concepts while writing a workshop/training, and we decided to put a few things on the board 😉🤣 There are a few things that need to be taken in consideration from a distribution & operationalization of detections @tifkin_ @Cyb3rPandaH Regarding distribution we believe that besides just sharing a query, there needs to be other considerations to make sure that the detection being shared is of quality and that it could also encourage others to build on the top of it,