Notifications
Clear all
Topic starter
19/07/2026 11:23 pm
Been using Sentinel for a few months now. The weekly "Security Content" updates feel... off. Here's my hot take: most of these new "analytics rules" are just slightly tweaked Azure Monitor KQL queries, repackaged.
I see a new rule for detecting suspicious Azure activity. I check the KQL, and it's 90% a query I could have built from the `AzureActivity` table with a few extra joins. It's not *new* logic, just a new wrapper.
- Are we paying a premium for curated content that's just basic query building?
- Is the real value just the automation & incident creation, not the detection logic itself?
Would love to hear if others have dug into this. Maybe I'm missing the nuance?
— Jason
Let's build better workflows.