Preserve source-event identifiers in aggregated Defender detection queries
How should an aggregated custom detection query retain the event context needed for its alert?
Read the guideDSE security knowledge hubSecurity knowledge,
Security knowledge,
without the noise.
Page 24 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
DSE-authoredOfficial sourcesReviewed guidance
Search the library DSE post stream
2,626 articlesGuidance and analysis from DSE
Archive Configuration Manager site backups before the next snapshot replaces them
Why is a successful Configuration Manager site-backup task insufficient evidence of multiple recovery points?
Read the guide
Keep the ESP blocking setting aligned with OOBE quality updates
Why can Windows quality updates be missed during setup even when their ESP option is enabled?
Read the guide
Regenerate Windows compatibility reports for the exact target release
What context must accompany an Intune Windows compatibility report used for an upgrade decision?
Read the guide
Separate autoscale condition evaluations from completed scaling actions
Use both autoscale log categories to explain a capacity change.
Read the guide
Normalize Azure resource-name casing in inventory comparisons
Avoid treating casing differences returned by APIs as separate resources.
Read the guide
Budget every Resource Graph result page against query quota
A paginated inventory consumes more than one query operation.
Read the guide
Review AS-path rewriting when Route Server connects dual-homed ExpressRoute networks
Check the documented NVA policy before diagnosing missing routes between route servers.
Read the guide
Update existing Linux iSCSI node settings after changing Elastic SAN client defaults
DSE recommends inventorying the connected volume IQNs and target portals before editing global defaults.
Read the guide
Keep Azure Files share copying separate from application cutover
DSE recommends listing the source account, share name, destination account, intended copy scope, and acceptance sample before starting.
Read the guide