This is so freaking cool! If you ingest sysmon or other data for a device, you can get a unified timeline view on the device in the Defender portal when you integrate Sentinel 🔥

Just showed up in my tenant :)

https://techcommunity.microsoft.com/blog/microsoftsentinelblog/introducing-the-unified-device-timeline-experience-in-microsoft-siem--xdr/4372047
Post image

Comments

Posting Rules

  • Be respectful to others
  • No spam or self-promotion
  • Stay on topic
  • Follow Bluesky's terms of service