↓ Skip to main content
Marvin Rose

About

Marvin Rose

I’m Marvin Rose, Cyber Security Architect at glueckkanja AG. Day to day I design and operate security platforms built on the Microsoft stack — Microsoft Sentinel, Defender XDR and Entra ID — for organisations that want detections they can trust and costs they can explain.

This blog is where I write down what I learn along the way: how things really work under the hood, the KQL I reach for, and the mistakes worth avoiding.

What you’ll find here
#

  • Microsoft Sentinel — ASIM, data lake, analytics rules, automation and cost control
  • Defender XDR — advanced hunting, custom detections, incident handling
  • Entra ID — Conditional Access, identity protection, workload identities
  • KQL — queries you can paste and use

Speaking
#

I regularly speak at community events. See Talks for past sessions.

Contact
#

The best way to reach me is LinkedIn. Code lives on GitHub.

Related

Projects

All queries live in my defenderxdr repository and are free to use. If something saves you time, a ⭐ on GitHub is the best thank-you. Sentinel cost and sizing # Conditional Access ingestion analysis: Correlates daily AADNonInteractiveUserSignInLogs ingestion with the number and state of Conditional Access policies, to find the policy changes behind a cost spike. View on GitHub →

Talks

I speak about Microsoft Sentinel, Defender XDR and Entra ID at community events and conferences. Want me at your meetup or conference? Reach out on LinkedIn. 20 October 2026 Normalize Once, Detect Everywhere: Inside Microsoft Sentinel's ASIM Security Ninjas Germany · Microsoft, Munich · Session · German with Jannis Langthaler Every data source speaks its own dialect. The Advanced Security Information Model (ASIM) gives Microsoft Sentinel one schema to rule them all: write a detection once and let parsers do the translation. We look at how ASIM parsers work under the hood, where performance bites, and how to build custom parsers for sources Microsoft doesn't ship. Microsoft SentinelASIMKQLDetection Engineering Slides