Mark Morowczynski's guest appearances

Mark Morowczynski

vBrownBag

BLUEPRINT

David Hill

Denis Dyack

Chris Baker

Josh Johnson

Safia Abdalla

Chris Porter

Howard Marks

Keith Thompson

Mike Wilson

Sean Duffy

Chris Williams

Christophe Limpalair

Hart Hoover

Michael Russell

Mike Nelson

OwlTail

We all need solid, well though-out playbooks to help standardize our respons to common threat scenarios. In this episode we speak with Thomas Detzner and Mark Morowczynski about the brand new set of Microsoft incident response playbooks that were just released. This is a brand new effort to meticulously document prerequisites, investigation steps, and remediation process for common scenarios most commonly seen by the Microsoft incident response teams, and you definitely won't want to miss it.Our Guests: Thomas Detzner and Mark MorowczynskiThomas Detzner is a Project Leader  for Microsoft, creating guidance for Azure AD IR.Mark Morowczynski (@markmorow) is a Principal Program Manager on the customer success team in the Microsoft Identity division. He spends most of his time working with customers on their deployments of Azure Active Directory. He can be frequently found on Twitter as @markmorow arguing about baseball and making sometimes funny gifs.Links:https://aka.ms/irplaybooks - Playbooks discussed in this episodehttps://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/tutorial-azure-monitor-stream-logs-to-event-hub#access-data-from-your-event-hub - Azure Event Hubhttps://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-final-for-windows-10-v1909-and-windows-server/ba-p/1023093 - Security Baslineshttps://www.microsoft.com/en-us/download/details.aspx?id=52630 - Security Auditing and Monitoring ReferenceSponsor's Note:Support for the Blueprint podcast comes from the SANS Institute.If you like the topics covered in this podcast and would like to learn more about blue team fundamentals such as host and network data collection, threat detection, alert triage, incident management, threat intelligence, and more, check out my new course SEC450: Blue Team Fundamentals.This course is designed to bring attendees the information that every SOC analyst and blue team member needs to know to hit the ground running, including 15 labs that get you hands on with tools for threat intel, SIEM, incident management, automation and much more, this course has everything you need to launch your blue team career.Check out the details at sansurl.com/450! Hope to see you in class!Follow SANS Cyber Defense: Twitter | LinkedIn | YouTubeFollow John Hubbard: Twitter | LinkedIn

We all need solid, well though-out playbooks to help standardize our respons to common threat scenarios. In this episode we speak with Thomas Detzner and Mark Morowczynski about the brand new set of Microsoft incident response playbooks that were just released. This is a brand new effort to meticulously document prerequisites, investigation steps, and remediation process for common scenarios most commonly seen by the Microsoft incident response teams, and you definitely won't want to miss it. Our Guests: Thomas Detzner and Mark Morowczynski Thomas Detzner is a Project Leader  for Microsoft, creating guidance for Azure AD IR. Mark Morowczynski (@markmorow) is a Principal Program Manager on the customer success team in the Microsoft Identity division. He spends most of his time working with customers on their deployments of Azure Active Directory. He can be frequently found on Twitter as @markmorow arguing about baseball and making sometimes funny gifs. Links:<a href="https://aka.ms/irplaybooks" rel="nofollow" target="_blank"> https://aka.ms/irplaybook</a>s - Playbooks discussed in this episode<a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-security-baselines" rel="nofollow" target="_blank"> https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/tutorial-azure-monitor-stream-logs-to-event-hub#access-data-from-your-event-hub</a> - Azure Event Hub <a href="https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-final-for-windows-10-v1909-and-windows-server/ba-p/1023093" rel="nofollow" target="_blank">https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-final-for-windows-10-v1909-and-windows-server/ba-p/1023093</a> - Security Baslines<a href="https://docs.microsoft.com/en-us/security/benchmark/azure/introduction" rel="nofollow" target="_blank"> </a><a href="https://www.microsoft.com/en-us/download/details.aspx?id=52630" rel="nofollow" target="_blank">https://www.microsoft.com/en-us/download/details.aspx?id=52630</a> - Security Auditing and Monitoring Reference Sponsor's Note: Support for the Blueprint podcast comes from the SANS Institute. If you like the topics covered in this podcast and would like to learn more about blue team fundamentals such as host and network data collection, threat detection, alert triage, incident management, threat intelligence, and more, check out my new course SEC450: Blue Team Fundamentals. This course is designed to bring attendees the information that every SOC analyst and blue team member needs to know to hit the ground running, including 15 labs that get you hands on with tools for threat intel, SIEM, incident management, automation and much more, this course has everything you need to launch your blue team career. Check out the details at <a href="https://sansurl.com/450" rel="nofollow" target="_blank">sansurl.com/450</a>! Hope to see you in class! Follow SANS Cyber Defense: <a href="https://twitter.com/sansdefense" rel="nofollow" target="_blank">Twitter</a> | <a href="https://www.linkedin.com/showcase/sans-cyber-security/" rel="nofollow" target="_blank">LinkedIn</a> | <a href="https://www.youtube.com/c/SANSBlueTeamOps" rel="nofollow" target="_blank">YouTube</a> Follow John Hubbard: <a href="https://twitter.com/sechubb" rel="nofollow" target="_blank">Twitter</a> | <a href="https://www.linkedin.com/in/johnlhubbard/" rel="nofollow" target="_blank">LinkedIn</a>

Mark Morowczynski & Thomas Detzner: Microsoft Incident Response Playbooks

Mark Morowczynski joins the Microsoft Azure series to talk about Azure Active DirectoryHave questions? as Mark on Twitter at https://twitter.com/markmorow

Mark Morowczynski joins the Microsoft Azure series to talk about Azure Active Directory Have questions? as Mark on Twitter at <a href="https://twitter.com/markmorow" rel="nofollow" target="_blank">https://twitter.com/markmorow</a>

#vBrownBag US Microsoft Azure AD with Mark Morowczynski (@markmorow)