Search the field manual.
A local, structured reference for Microsoft security products, licenses, capabilities, tables, schemas, APIs, and the relationships between them.
Field Guides and Cheatsheets
Build MDE From Scratch
Capability and table relationships for Defender for Endpoint.
ShortcutMDE + Intune Guide
Policies, settings, rollout options, and device-risk integration.
ShortcutSeparate MDCA and MDC
Clarify Defender for Cloud Apps, Defender for Cloud, CloudAppEvents, and CloudAuditEvents.
ShortcutPlan Unified RBAC
Map Defender XDR unified RBAC activation, scopes, role groups, and Sentinel boundaries.
ShortcutDetect Missing MDE Licensing
Find inactive Defender for Endpoint entitlement before deploying Sentinel Device table content.
ShortcutFind a Table
Browse Defender for Endpoint hunting tables.
ShortcutFind a Field
Map schema fields to tables, licenses, and APIs.
ShortcutUse KQL Examples
Open attributed KQL examples for Sentinel, Defender XDR, Intune, and threat intel.
ShortcutStudy for SC-200
Map current Microsoft Security Operations Analyst exam domains to hands-on site references.
ShortcutCompare Schemas
Compare shared and unique fields across tables.
ShortcutFind an API Permission
Map app-registration permission resources to security APIs.
ShortcutSnapshot Identity Permissions
Use Microsoft Graph snapshots for Entra roles and API permission resources.
ShortcutDeploy Sentinel From Scratch
Walk through the decision-driven greenfield Sentinel build guide.
ShortcutDesign Sentinel Data Lake
Plan table tiers, export rules, ADLS, ADX, search jobs, and cost formulas.
ShortcutExport Without Sentinel
Map Microsoft telemetry to Event Hubs, Storage, APIs, and third-party SIEM collectors.
ShortcutMap Google SecOps Types
Translate Microsoft and Azure log types, parser status, and table mappings to Google SecOps.
ShortcutOpen GH Starter
Download Sentinel greenfield starter files as Markdown and text copies.
ShortcutUse Security APIs
Follow task-based workflows for Sentinel, KQL, IOC ingestion, and MDE actions.
ShortcutPlan IaC
Terraform workflows and non-Terraform gaps for Sentinel and Defender XDR.
ShortcutEstimate Sentinel Cost
Compare commitment, retention, table plan, and Microsoft 365 E5 credit levers.
ShortcutCompare MDE Licenses
Compare Defender for Endpoint P1 and P2.
ShortcutCompare MDO Licenses
Compare Defender for Office 365 P1 and P2.