Threat Hunting

Platforms: Microsoft Defender XDR, Microsoft Sentinel, CrowdStrike Falcon

Proactive, hypothesis-driven hunting mapped to MITRE ATT&CK across Defender XDR, Microsoft Sentinel and CrowdStrike Falcon.

Microsoft Security Stack

Platforms: Defender XDR, Microsoft Sentinel, Entra ID, Microsoft Purview

Defender XDR, Sentinel (SIEM and SOAR), Entra ID and Purview: deployment, hardening, tuning and detection engineering.

CrowdStrike Platform

Platforms: CrowdStrike Falcon, Falcon NG-SIEM, Falcon LogScale

Falcon: deployment, policy tuning, NG-SIEM and LogScale, and hunting over Falcon telemetry.

Detection Engineering and Response

Platforms: Microsoft Sentinel, CrowdStrike Falcon

Building detections, playbooks and incident response support.