October Updates

Author: alexverboon

docs/entraid.md

@@ -1761,6 +1761,9 @@
 
 ## Community Blogs
 
+- [Detect threats using GraphAPIAuditEvents - Part 3](https://cloudbrothers.info/detect-threats-graphapiauditevents-part-3/)
+- [Detect threats using Microsoft Graph activity logs - Part 2](https://cloudbrothers.info/detect-threats-microsoft-graph-logs-part-2/)
+- [Detect threats using Microsoft Graph activity logs - Part 1](https://cloudbrothers.info/detect-threats-microsoft-graph-logs-part-1/)
 - [Entra: Retrieve Entra Connect Version Information](https://www.french365connection.co.uk/post/entra-retrieve-entra-connect-version-information)
 - [How to Secure Redirect URIs in Microsoft Entra ID Applications](https://ourcloudnetwork.com/how-to-secure-redirect-uris-in-microsoft-entra-id-applications/)
 - [What is Tier Zero — Part 1](https://posts.specterops.io/what-is-tier-zero-part-1-e0da9b7cdfca)

docs/learn.md

@@ -38,7 +38,12 @@
 ## Entra
 
 - [Microsoft Entra Suite: Comprehensive Zero Trust user access at your fingertips](https://www.youtube.com/watch?v=olAqPx7CTcM&list=PLmAptfqzxVEXzNRk276m5ssJk4YOM1H3w)
+- [Microsoft Entra Suite](https://www.youtube.com/watch?v=olAqPx7CTcM&list=PLmAptfqzxVEXzNRk276m5ssJk4YOM1H3w)
 
 ## Microsoft Cybersecurity Architect (SC-100)
 
 - [Video Training](https://www.youtube.com/playlist?list=PLahhVEj9XNTfRZMathQ5fn1akTwV7R3w_)
+
+## Tools
+
+- [Docs Tracker](https://docstracker.marshsecurity.org/)

docs/mdc.md

@@ -8,6 +8,10 @@
 
 ## Microsoft Tech Community Blogs
 
+- [Securing GenAI Workloads in Azure: A Complete Guide to Monitoring and Threat Protection - AIO11Y](https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/securing-genai-workloads-in-azure-a-complete-guide-to-monitoring-and-threat-prot/4463145)
+- [Secure AI by Design Series: Embedding Security and Governance Across the AI Lifecycle](https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/secure-ai-by-design-series-embedding-security-and-governance-across-the-ai-lifec/4457200)
+- [Defender for Storage: Malware Automated Remediation - From Security to Protection](https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/defender-for-storage-malware-automated-remediation---from-security-to-protection/4457040)
+- [Automated Remediation for Malware Detection - Defender for Storage](https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/automated-remediation-for-malware-detection---defender-for-storage/4454641)
 - [New feature in Defender for Storage: Optional Index Tags](https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/new-feature-in-defender-for-storage-optional-index-tags/4427987)
 - [Optimizing Resource Allocation with Microsoft Defender CSPM](https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/optimizing-resource-allocation-with-microsoft-defender-cspm/4427785)
 - [Microsoft Named a Leader in the IDC MarketScape for CNAPP: Key Takeaways for Security Buyers](https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/microsoft-named-a-leader-in-the-idc-marketscape-for-cnapp-key-takeaways-for-secu/4427071)

docs/mde.md

@@ -12,6 +12,9 @@
 
 ## Microsoft Tech Community Blogs
 
+- [End of Windows 10 Support: What Defender Customers Need to Know](https://techcommunity.microsoft.com/blog/microsoftdefenderatpblog/end-of-windows-10-support-what-defender-customers-need-to-know/4461349)
+- [Multi-tenant endpoint security policies distribution is now in Public Preview](https://techcommunity.microsoft.com/blog/microsoftdefenderatpblog/multi-tenant-endpoint-security-policies-distribution-is-now-in-public-preview/4439929)
+- [Maintain connectivity for essential services with selective network isolation](https://techcommunity.microsoft.com/blog/microsoftdefenderatpblog/maintain-connectivity-for-essential-services-with-selective-network-isolation/4422938)
 - [Behavior monitoring is now generally available for Microsoft Defender for Endpoint on macOS](https://techcommunity.microsoft.com/blog/microsoftdefenderatpblog/behavior-monitoring-is-now-generally-available-for-microsoft-defender-for-endpoi/4415697)
 - [Manage global exclusion policies for Linux across both AV and EDR](https://techcommunity.microsoft.com/blog/microsoftdefenderatpblog/manage-global-exclusion-policies-for-linux-across-both-av-and-edr/4420127)
 - [Discover how automatic attack disruption protects critical assets while ensuring business continuity](https://techcommunity.microsoft.com/blog/microsoftdefenderatpblog/discover-how-automatic-attack-disruption-protects-critical-assets-while-ensuring/4416597)
@@ -260,6 +263,10 @@
 
 ## Community Blogs
 
+- [Tracking a device’s IP assignments with MDE’s DeviceNetworkInfo table](https://medium.com/@cybureauocracy/tracking-a-devices-ip-assignments-with-mde-s-devicenetworkinfo-table-430270ca539e)
+- [MDE’s DeviceNetworkEvents table [Part 2 — Connection* ActionTypes]](https://medium.com/@cybureauocracy/mdes-devicenetworkevents-table-part-2-connection-actiontypes-1c5ee20d2fc4)
+- [Understanding MDE’s DeviceNetworkEvents table for SOC analysts [Part 1 — Overview]](https://medium.com/@cybureauocracy/mdes-devicenetworkevents-table-for-soc-analysts-part-1-overview-094ca99b50c9)
+- [P5: Live Response in MDE](https://secureazcloud.com/microsoft-security/f/p5-live-response-in-mde?blogcategory=DEFENDER+FOR+ENDPOINT)
 - [IoC's in Defender for Endpoint](https://www.indefent.com/iocs-in-defender-for-endpoint/)
 - [Isolation Exclusion Rules: Fixing Microsoft Teams & Outlook Communication During Isolation](https://www.lousec.be/mde/isolation-exclusion-rules-fixing-microsoft-teams-outlook-communication-during-isolation/)
 - [Detecting Vulnerable Drivers (a.k.a. LOLDrivers) the Right Way Using Microsoft Defender for Endpoint](https://academy.bluraven.io/blog/detecting-vulnerable-drivers-using-defender-for-endpoint-kql)
@@ -357,3 +364,4 @@
 - [MDE Troubleshooter](https://github.com/ThomasVrhydn/MDE-troubleshooter)
 - [Powershell Digital Forensics & Incident Response](https://github.com/Bert-JanP/Incident-Response-Powershell)
 - [Defender for Endpoint docs](https://github.com/MicrosoftDocs/defender-docs/tree/public/defender-endpoint)
+- [Microsoft Vulnerable Driver Block Lists](https://github.com/Cyb3r-Monk/Microsoft-Vulnerable-Driver-Block-Lists)

docs/mdi.md

@@ -7,6 +7,9 @@
 
 ## Microsoft Tech Community Blogs
 
+- [Monthly news - October 2025](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/monthly-news---october-2025/4458349)
+- [How Microsoft Defender helps security teams detect prompt injection attacks in Microsoft 365 Copilot](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/how-microsoft-defender-helps-security-teams-detect-prompt-injection-attacks-in-m/4457047)
+- [Announcing General Availability: Unified identity and endpoint sensor](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/announcing-general-availability-unified-identity-and-endpoint-sensor/4463585)
 - [Scope Identity Protection with Defender for Identity](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/new-scope-identity-protection-with-defender-for-identity/4422968)
 - [Microsoft Defender for Identity has announced the public preview of a new service account discovery module that automatically identifies and classifies service accounts in Active Directory](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/discover-and-protect-service-accounts-with-microsoft-defender-for-identity/4395347)
 - [Expanding the Identity perimeter: the rise of non-human identities](https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/expanding-the-identity-perimeter-the-rise-of-non-human-identities/4418953)

docs/mdo.md

@@ -7,6 +7,9 @@
 
 ## Microsoft Tech Community Blogs
 
+- [Microsoft Defender for Office 365: Migration & Onboarding](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/microsoft-defender-for-office-365-migration--onboarding/4462906)
+- [Protection against multi-modal attacks with Microsoft Defender](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/protection-against-multi-modal-attacks-with-microsoft-defender/4438786)
+- [Submissions Response Using AI for Enhanced Result Explainability](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/submissions-response-using-ai-for-enhanced-result-explainability/4423843)
 - [Protection Against Email Bombs with Microsoft Defender for Office 365](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/protection-against-email-bombs-with-microsoft-defender-for-office-365/4418048)
 - [Introducing the Microsoft Defender for Office 365 ICES vendor ecosystem](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/introducing-the-microsoft-defender-for-office-365-ices-vendor-ecosystem/4424817)
 - [Auto-Remediation of Malicious Messages in Automated Investigation and Response (AIR) is GA](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/auto-remediation-of-malicious-messages-in-automated-investigation-and-response-a/4418047?previewMessage=true)

docs/mdxdr.md

@@ -103,6 +103,7 @@
 
 ## Community Blogs
 
+- [Remove old or orphaned Sentinels from the XDR Streaming API](https://cloudbrothers.info/remove-orphaned-sentinels-xdr-streaming-api/)
 - [Detect security policy changes](https://www.lousec.be/ad/detect-security-policy-changes/)
 - [Windows Defender: Threat Hunting Campaign Ideas](https://www.linkedin.com/pulse/windows-defender-threat-hunting-campaign-ideas-adair-collins-lefze/)
 - [Microsoft Defender: Detecting Bumblebee Malware](https://www.linkedin.com/pulse/microsoft-defender-detecting-bumblebee-malware-adair-collins-dqc1e/)
@@ -135,6 +136,7 @@
 
 - [EDR Telemetry](https://www.edr-telemetry.com/index.html)
 - [GraphWeaver: Billion-Scale Cybersecurity Incident Correlation](https://arxiv.org/abs/2406.01842)
+- [(Microsoft XDR table schema](https://xdrinternals.com/)
 
 ## Attack Simulations & Testing
 

docs/securitycopilot.md

@@ -93,3 +93,4 @@
 - [Learn Live: Get started with Microsoft Copilot for Security](https://learn.microsoft.com/en-us/shows/learn-live/microsoft-copilot-for-security/)
 - [How to Become a Microsoft Security Copilot Ninja: The Complete Level 400 Training](https://techcommunity.microsoft.com/blog/securitycopilotblog/how-to-become-a-microsoft-security-copilot-ninja-the-complete-level-400-training/4106928)
 - [LinkedIn Learn - Security Copilot](https://www.linkedin.com/learning/topics/microsoft-security-copilot)
+- [Security Copilot Skilling Series](https://www.youtube.com/watch?v=Rfx_4nMko1o&list=PLmAptfqzxVEWGjqfUaMx9R2DjPjrXrfjK)

docs/sentinel.md

@@ -8,6 +8,14 @@
 
 ## Microsoft Tech Community Blogs
 
+- [Introducing Microsoft Sentinel graph (Public Preview)](https://techcommunity.microsoft.com/blog/microsoft-security-blog/introducing-microsoft-sentinel-graph-public-preview/4456368)
+- [Microsoft Sentinel data lake is now generally available](https://techcommunity.microsoft.com/blog/microsoft-security-blog/microsoft-sentinel-data-lake-is-now-generally-available/4456342)
+- [New bi-directional export for TI in Microsoft Sentinel and strategic Cyware partnership](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/new-bi-directional-export-for-ti-in-microsoft-sentinel-and-strategic-cyware-part/4457947)
+- [6 truths about migrating Microsoft Sentinel to the Defender portal](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/6-truths-about-migrating-microsoft-sentinel-to-the-defender-portal/4460437)
+- [Microsoft Sentinel data lake FAQ](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/microsoft-sentinel-data-lake-faq/4457728)
+- [App Assure's Sentinel promise now extends to Microsoft Sentinel data lake](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/app-assures-sentinel-promise-now-extends-to-microsoft-sentinel-data-lake/4454612)
+- [Microsoft Sentinel and Defender: ITSM Integrations Explained](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/microsoft-sentinel-and-defender-itsm-integrations-explained/4457282)
+- [Automate Security Workflows in Microsoft Sentinel with BlinkOps](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/automate-security-workflows-in-microsoft-sentinel-with-blinkops/4454575)
 - [Microsoft Sentinel’s AI-driven UEBA ushers in the next era of behavioral analytics](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/microsoft-sentinel%E2%80%99s-ai-driven-ueba-ushers-in-the-next-era-of-behavioral-analyti/4448390)
 - [How to: Ingest Splunk alert data to Microsoft Sentinel SIEM](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/how-to-ingest-splunk-alert-data-to-microsoft-sentinel-siem/4449027)
 - [Table Talk: Sentinel’s New ThreatIntel Tables Explained](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/table-talk-sentinel%E2%80%99s-new-threatintel-tables-explained/4440273)
@@ -571,6 +579,7 @@
 
 ## Community Blogs
 
+- [Protecting Your Microsoft Sentinel Solution from Deletion or Corruption](https://cybermohr.ghost.io/2025/05/28/protecting-your-microsoft-sentinel-solution-from-deletion-or-corruption/)
 - [SentinelCodeGuard: A Journey from Concept to VS Code Plugin](https://sentinel.blog/sentinelcodeguard-a-journey-from-concept-to-vs-code-plugin/)
 - [SentinelCodeGuard: Revolutionising Microsoft Sentinel Rule Development](https://sentinel.blog/sentinelcodeguard-revolutionizing-microsoft-sentinel-rule-development/)
 - [Simplifying Azure Log Analytics Table Retention Management: A Modern Approach](https://sentinel.blog/simplifying-azure-log-analytics-table-retention-management-a-modern-approach/)