Cybersecurity deep-dives: Microsoft Sentinel, detection engineering, LLM hardening and security tooling.https://graewer.com/enhttps://graewer.com/blog/rogueplanet-defender-lpe/https://graewer.com/blog/rogueplanet-defender-lpe/CVE-2026-50656 is patched, but the fix ships as an engine update, not a Patch Tuesday KB. What RoguePlanet does, how it rhymes with BlueHammer, and the retrospective hunt and patch validation blue teams still owe themselves.Sun, 12 Jul 2026 00:00:00 GMTwindowsdefendervulnerabilitydetection-engineeringsentinellpekqlhttps://graewer.com/blog/classic-ai-agents-sentinel-detection/https://graewer.com/blog/classic-ai-agents-sentinel-detection/Microsoft Entra Agent ID secures the agents you build tomorrow. The service principals and managed identities you already run - the classic agents - are a different story. Two KQL detections, the diagnostic switch nobody flips, and what to do this week.Wed, 17 Jun 2026 00:00:00 GMTmicrosoft-sentinelentra-idnon-human-identitiesai-agentsdetection-engineeringkqlservice-principalshttps://graewer.com/blog/sentinel-msem-incident-enrichment/https://graewer.com/blog/sentinel-msem-incident-enrichment/MSEM gives Sentinel something it never had: asset criticality and attack-path context per entity. Architecture, KQL patterns for incident enrichment, and the entity-matching pitfalls that quietly break them.Thu, 23 Apr 2026 00:00:00 GMTmicrosoft-sentinelmsemdefender-xdrexposure-managementkqldetection-engineeringhttps://graewer.com/blog/bluehammer-windows-lpe/https://graewer.com/blog/bluehammer-windows-lpe/What we know about the BlueHammer zero-day, where the public exploit chain is fragile, and what blue teams can actually do today.Tue, 07 Apr 2026 00:00:00 GMTwindowsdefendervulnerabilitydetection-engineeringsentinellpehttps://graewer.com/blog/sentinel-data-lake-migration/https://graewer.com/blog/sentinel-data-lake-migration/The Sentinel Data Lake Tier changes the cost equation for high-volume security logging. Architecture, migration playbook, KQL examples, and the pitfalls nobody warns you about.Sat, 04 Apr 2026 00:00:00 GMTmicrosoft-sentinelazuresiemdata-lakekqlcost-optimizationhttps://graewer.com/blog/llm-hardening/https://graewer.com/blog/llm-hardening/A technical deep-dive into securing LLM-based agent deployments against prompt injection, data exfiltration, and tool abuse. Based on real-world hardening of OpenClaw-based systems.Mon, 23 Feb 2026 00:00:00 GMTllm-securityprompt-injectionhardeningopenclawowasphttps://graewer.com/blog/building-heimdall/https://graewer.com/blog/building-heimdall/How I built a FastMCP-based threat intelligence toolset that integrates VirusTotal, AbuseIPDB, Shodan, and MITRE ATT&CK mapping. The messy reality of building security tools, including the bugs.Sat, 15 Mar 2025 00:00:00 GMTthreat-intelligencemcppythonsoctooling