[{"content":" I\u0026rsquo;m Marvin Rose, Cyber Security Architect at glueckkanja AG. Day to day I design and operate security platforms built on the Microsoft stack — Microsoft Sentinel, Defender XDR and Entra ID — for organisations that want detections they can trust and costs they can explain.\nThis blog is where I write down what I learn along the way: how things really work under the hood, the KQL I reach for, and the mistakes worth avoiding.\nWhat you\u0026rsquo;ll find here # Microsoft Sentinel — ASIM, data lake, analytics rules, automation and cost control Defender XDR — advanced hunting, custom detections, incident handling Entra ID — Conditional Access, identity protection, workload identities KQL — queries you can paste and use Speaking # I regularly speak at community events. See Talks for past sessions.\nContact # The best way to reach me is LinkedIn. Code lives on GitHub.\n","externalUrl":null,"permalink":"/about/","section":"Marvin Rose","summary":" I’m Marvin Rose, Cyber Security Architect at glueckkanja AG. Day to day I design and operate security platforms built on the Microsoft stack — Microsoft Sentinel, Defender XDR and Entra ID — for organisations that want detections they can trust and costs they can explain.\n","title":"About","type":"page"},{"content":"","externalUrl":null,"permalink":"/categories/","section":"Categories","summary":"","title":"Categories","type":"categories"},{"content":"","externalUrl":null,"permalink":"/","section":"Marvin Rose","summary":"","title":"Marvin Rose","type":"page"},{"content":"","externalUrl":null,"permalink":"/posts/","section":"Posts","summary":"","title":"Posts","type":"posts"},{"content":"All queries live in my defenderxdr repository and are free to use. If something saves you time, a ⭐ on GitHub is the best thank-you.\nSentinel cost and sizing # Conditional Access ingestion analysis: Correlates daily AADNonInteractiveUserSignInLogs ingestion with the number and state of Conditional Access policies, to find the policy changes behind a cost spike. View on GitHub →\nEntra ID data connector sizing: Estimates the ingestion volume of the Sentinel Microsoft Entra ID connector before you enable it, using Defender XDR Advanced Hunting as a proxy. View on GitHub →\nDefender table sizing: Estimates log size and average record size for Defender for Endpoint, Defender for Office 365 and Defender for Cloud Apps tables over the last 30 days, per table and in total. View on GitHub →\nEntra ID sign-ins # Failed non-interactive sign-ins: Top apps and top users with failed non-interactive sign-ins, including affected users and client app types. View on GitHub →\nDefender for Endpoint # mshta.exe outbound hunting: Surfaces outbound network connections from mshta.exe with full parent-process context, to spot LOLBin abuse for payload delivery or command and control. View on GitHub →\nScheduled scan validation (macOS and Linux): Verifies that quick scans actually complete on non-Windows endpoints and visualises the trend, to catch coverage gaps and configuration drift. View on GitHub →\n","externalUrl":null,"permalink":"/projects/","section":"Marvin Rose","summary":"All queries live in my defenderxdr repository and are free to use. If something saves you time, a ⭐ on GitHub is the best thank-you.\nSentinel cost and sizing # Conditional Access ingestion analysis: Correlates daily AADNonInteractiveUserSignInLogs ingestion with the number and state of Conditional Access policies, to find the policy changes behind a cost spike. View on GitHub →\n","title":"Projects","type":"page"},{"content":"","externalUrl":null,"permalink":"/series/","section":"Series","summary":"","title":"Series","type":"series"},{"content":"","externalUrl":null,"permalink":"/tags/","section":"Tags","summary":"","title":"Tags","type":"tags"},{"content":"I speak about Microsoft Sentinel, Defender XDR and Entra ID at community events and conferences. Want me at your meetup or conference? Reach out on LinkedIn.\n20 October 2026 Normalize Once, Detect Everywhere: Inside Microsoft Sentinel\u0026#39;s ASIM Security Ninjas Germany · Microsoft, Munich · Session · German with Jannis Langthaler Every data source speaks its own dialect. The Advanced Security Information Model (ASIM) gives Microsoft Sentinel one schema to rule them all: write a detection once and let parsers do the translation. We look at how ASIM parsers work under the hood, where performance bites, and how to build custom parsers for sources Microsoft doesn\u0026#39;t ship.\nMicrosoft SentinelASIMKQLDetection Engineering Slides ","externalUrl":null,"permalink":"/talks/","section":"Marvin Rose","summary":"I speak about Microsoft Sentinel, Defender XDR and Entra ID at community events and conferences. Want me at your meetup or conference? Reach out on LinkedIn.\n20 October 2026 Normalize Once, Detect Everywhere: Inside Microsoft Sentinel's ASIM Security Ninjas Germany · Microsoft, Munich · Session · German with Jannis Langthaler Every data source speaks its own dialect. The Advanced Security Information Model (ASIM) gives Microsoft Sentinel one schema to rule them all: write a detection once and let parsers do the translation. We look at how ASIM parsers work under the hood, where performance bites, and how to build custom parsers for sources Microsoft doesn't ship.\nMicrosoft SentinelASIMKQLDetection Engineering Slides ","title":"Talks","type":"page"}]