Resource shelf

Identity governance, conditional access, and lifecycle workflows. Dense, and the primary source for anything identity-shaped.

How most automation in this lab reaches the tenant. Check the permission scope each cmdlet actually requires — the names are optimistic.

The reference for access packages, catalogs, and approval workflows. Read this before designing a catalog structure, not after.

Entra Connect, Cloud Sync, and the sync engine behavior behind every hybrid-join edge case.

Onboarding, advanced hunting, and attack surface reduction — the product surface most of this lab's detections run against.

Identity-based detection for on-prem AD DS — the piece that makes hybrid identity monitoring possible at all.

Cross-product correlation. Where a Defender for Endpoint alert and a Defender for Identity alert are supposed to become one incident.

Analytics rules, hunting queries, and workbooks in the open. A good place to see how a rule is structured before writing your own.

Still the reference every detection gets mapped back to. Read the data sources section, not just the technique list.

Small, scoped technique tests. The simulation half of every detection on this bench.

Vendor-neutral detection rules. Useful as a source of logic even when the final query gets hand-written in KQL.

The full query language, not the cheat sheet. Worth an afternoon — most slow detections are a missing operator away from being fast.

Deployment guidance rather than slogans. Most useful as a checklist against an environment you already have.

A vendor-neutral maturity view. Handy when you need to describe where an organization actually sits, not where the vendor slide says it sits.

Policy design, report-only mode, and the troubleshooting workflow for when a policy blocks the wrong thing at the wrong time.

The underlying reference architecture most vendor documentation is quietly built on top of.

The Top 10 for LLM applications, plus the agentic security work. The most useful shared vocabulary for AI-specific risk right now.

ATT&CK's structure applied to attacks on machine-learning systems. Useful for turning a vague worry about an agent into a testable technique.

Microsoft's automation framework for probing generative AI systems. Turns ad-hoc red teaming into something repeatable.

The inference runtime behind the local AI thread here — full detail on the sibling lab, gribbite.com.