WEBVTT 00:00:10.109 --> 00:00:12.609 Hello, everybody, and welcome back to another 00:00:12.609 --> 00:00:15.470 episode of the Everyday Defender. I'm joined 00:00:15.470 --> 00:00:17.710 here once again with my friend from Down Under. 00:00:18.190 --> 00:00:20.629 Hi, Chris. How are you doing? Coastal, doing 00:00:20.629 --> 00:00:23.129 well. How are you, sir? I'm sorry for that very 00:00:23.129 --> 00:00:26.250 fake, weird accent. But every time I hear somebody 00:00:26.250 --> 00:00:28.850 say Down Under, I'm thinking barbecue and nice 00:00:28.850 --> 00:00:31.629 weather and Crocodile Dundee. Well, you know, 00:00:31.670 --> 00:00:33.649 you didn't say let's put some shrimp on the barbie, 00:00:33.670 --> 00:00:36.270 did you? So I guess we're still... I didn't want 00:00:36.270 --> 00:00:38.549 to say that. We can still rescue it from there. 00:00:38.630 --> 00:00:42.590 So it's all good. We'll do some South Africans 00:00:42.590 --> 00:00:47.909 next time. Oh, geez. Oh, geez. No, how are you 00:00:47.909 --> 00:00:49.789 doing, man? Yeah, I'm doing really well. Doing 00:00:49.789 --> 00:00:52.460 well. It's been really... It's been really busy. 00:00:52.539 --> 00:00:54.340 I can't actually believe that another month, 00:00:54.359 --> 00:00:56.119 and I say this every month, right? I can't believe 00:00:56.119 --> 00:00:57.719 the month's gone by already, but, you know, it 00:00:57.719 --> 00:01:00.140 just is how it is. And we're at that sort of 00:01:00.140 --> 00:01:02.659 time of year now, I think, where it's downhill 00:01:02.659 --> 00:01:04.980 to the end of the year. And so everything is 00:01:04.980 --> 00:01:07.480 just going at full speed. You know, I don't know 00:01:07.480 --> 00:01:09.620 about you, but I, you know, I'm really, really 00:01:09.620 --> 00:01:11.980 busy with the day job and keeping up with everything. 00:01:12.040 --> 00:01:14.900 And it's just, you know. constant things right 00:01:14.900 --> 00:01:17.780 i'm already already looking at planning mvp summit 00:01:17.780 --> 00:01:20.079 which is in march so there's you know that stuff 00:01:20.079 --> 00:01:22.219 going on and we were just talking now you know 00:01:22.219 --> 00:01:25.340 before we hit record we were talking about uh 00:01:25.340 --> 00:01:28.180 experts live in june right like you know what 00:01:28.180 --> 00:01:30.299 are we doing here like it's it's you know we're 00:01:30.299 --> 00:01:33.450 still in 236 but life is moving very very quickly 00:01:33.450 --> 00:01:36.590 so yeah for me personally i'm still in like a 00:01:36.590 --> 00:01:39.650 little bit of ignorance mode when it comes to 00:01:39.650 --> 00:01:42.430 the summer has ended or is ending right now over 00:01:42.430 --> 00:01:44.750 here because i have still my holiday in front 00:01:44.750 --> 00:01:47.030 of me so while people are listening to this episode 00:01:47.030 --> 00:01:50.629 i am in the most southern part of spain driving 00:01:50.629 --> 00:01:53.450 around enjoying some nice weather so i'm still 00:01:53.450 --> 00:01:56.969 holding on to that last bit of sunshine in front 00:01:56.969 --> 00:01:59.170 of me and then obviously afterwards it's like 00:01:59.170 --> 00:02:03.090 uh holidays and december and new year's eve before 00:02:03.090 --> 00:02:05.769 you know it i know yeah the part of getting a 00:02:05.769 --> 00:02:08.270 little bit older chris uh when we experience 00:02:08.270 --> 00:02:11.710 time going faster i don't know about you yeah 00:02:11.710 --> 00:02:14.050 no that's fair i think uh you know they say youth 00:02:14.050 --> 00:02:15.849 is wasted on the young i think that's that's 00:02:15.849 --> 00:02:18.750 that's very true so but we may as well get uh 00:02:18.750 --> 00:02:21.409 cracking into it today um i gotta tell you man 00:02:21.409 --> 00:02:23.530 i looked obviously as i always do i i looked 00:02:23.530 --> 00:02:25.750 at the show notes when i woke up this morning 00:02:25.750 --> 00:02:27.469 first thing and because of the way the time zones 00:02:27.469 --> 00:02:30.919 work you've usually submitted your show notes 00:02:30.919 --> 00:02:35.039 when you go to bed at night, which is a few hours 00:02:35.039 --> 00:02:37.800 before I wake up on that same day. Well, the 00:02:37.800 --> 00:02:40.599 next day, anyway. And I had a look at the show 00:02:40.599 --> 00:02:42.199 notes this morning and I was like, wow, this 00:02:42.199 --> 00:02:44.400 is going to be a cool topic. So I'm really excited 00:02:44.400 --> 00:02:46.120 to talk about this stuff. This is the stuff that 00:02:46.120 --> 00:02:48.620 I really love. I really love all of this sort 00:02:48.620 --> 00:02:52.780 of automation stuff and workflow stuff. And I've 00:02:52.780 --> 00:02:54.379 been really lucky lately. I've been sort of getting 00:02:54.379 --> 00:02:56.860 a little bit hands -on with some of the, not 00:02:56.860 --> 00:02:58.879 this exact technology, but this type of stuff 00:02:58.879 --> 00:03:02.460 with some of my client work. So I'm really excited 00:03:02.460 --> 00:03:04.759 to hear about it. Do you want to tell everyone 00:03:04.759 --> 00:03:06.490 what you're going to be talking about? Yeah, 00:03:06.509 --> 00:03:08.490 great to hear that, Chris. So yeah, of course. 00:03:08.590 --> 00:03:11.370 So I was working a lot recently, not only the 00:03:11.370 --> 00:03:14.530 last couple of weeks, but even last year, year 00:03:14.530 --> 00:03:17.330 and a half, a lot with workflows. Because as 00:03:17.330 --> 00:03:20.569 you know, I work with a company where we provide 00:03:20.569 --> 00:03:22.990 a managed SOC, if you will. So we have a lot 00:03:22.990 --> 00:03:25.050 of automation going on for a lot of our customers 00:03:25.050 --> 00:03:29.969 at scale. And we'll dive into more details later. 00:03:30.110 --> 00:03:32.870 But Logic Apps is the Microsoft default for workflows 00:03:32.870 --> 00:03:36.039 and automation, which is not very... good in 00:03:36.039 --> 00:03:38.819 a lot of regards. It has its pros, but especially 00:03:38.819 --> 00:03:42.099 for MSSP and scale, it's not the ideal tool. 00:03:42.259 --> 00:03:44.860 So we looked into different options and we landed 00:03:44.860 --> 00:03:48.060 on N8n. You heard about it. You mentioned before 00:03:48.060 --> 00:03:50.240 we started recording, you looked into it earlier. 00:03:50.460 --> 00:03:54.080 And N8n is really logic apps on steroids, if 00:03:54.080 --> 00:03:57.000 you ask me. A lot of quality of life improvements 00:03:57.000 --> 00:03:59.360 when it comes to the UI and how you interact 00:03:59.360 --> 00:04:04.159 with it, but also vastly more possibilities and 00:04:04.159 --> 00:04:06.810 integration. and everything. So, yeah, I'd like 00:04:06.810 --> 00:04:09.750 to talk about N8M and my experience so far with 00:04:09.750 --> 00:04:14.110 it as a SOAR tool in our case. And what about 00:04:14.110 --> 00:04:15.909 you, Chris? Yeah, that's going to be very cool, 00:04:15.969 --> 00:04:18.509 I think. You know, definitely think, like you 00:04:18.509 --> 00:04:20.970 said, Logic Apps, I feel like they've embraced 00:04:20.970 --> 00:04:24.180 that sort of... low code, no code ethos. But 00:04:24.180 --> 00:04:27.040 because of that, it just falls short sometimes 00:04:27.040 --> 00:04:29.160 when it comes to scaling. So this is going to 00:04:29.160 --> 00:04:30.959 be really cool. I've been thinking a lot about 00:04:30.959 --> 00:04:34.160 dynamic groups. And so it's not the sexiest topic, 00:04:34.259 --> 00:04:36.740 to be honest, but there are a few little dynamic 00:04:36.740 --> 00:04:39.480 groups things. One change in particular coming 00:04:39.480 --> 00:04:43.120 here in the next couple of months that I think 00:04:43.120 --> 00:04:45.519 is going to trip a lot of customers up. We talked 00:04:45.519 --> 00:04:50.160 last month about the deprecation of SMS and mobile 00:04:50.160 --> 00:04:56.550 phone. MFA factors, right? And since the last 00:04:56.550 --> 00:05:00.110 conversation we had in that recording, I have 00:05:00.110 --> 00:05:02.389 talked to two customers who have been affected 00:05:02.389 --> 00:05:05.209 by that change, right? Two very large customers 00:05:05.209 --> 00:05:08.689 who have had that change affect them. And so, 00:05:08.730 --> 00:05:11.850 again, funny that we're used to Microsoft giving 00:05:11.850 --> 00:05:14.029 us lots of runway and lots of time for these 00:05:14.029 --> 00:05:17.480 changes. that one there wasn't so much time this 00:05:17.480 --> 00:05:19.680 one uh that i want to talk about or one of the 00:05:19.680 --> 00:05:21.300 ones i want to talk about with dynamic groups 00:05:21.300 --> 00:05:24.579 also not a lot of time for for us to get prepared 00:05:24.579 --> 00:05:26.199 and get ready for it so i wanted to bring that 00:05:26.199 --> 00:05:28.040 to everyone's attention and hopefully that helps 00:05:28.040 --> 00:05:30.279 some folks out but uh yeah before we get into 00:05:30.279 --> 00:05:33.019 that let's hear about uh logic apps leaving the 00:05:33.019 --> 00:05:36.459 chat um yeah i thought that was a fitting title 00:05:36.459 --> 00:05:39.399 for this episode yeah so first of all when you 00:05:39.399 --> 00:05:42.199 talk about n8 and and everybody who knows me 00:05:42.199 --> 00:05:44.839 and works with me know that i really value the 00:05:45.069 --> 00:05:48.709 Correct pronunciation of things. I see Chris 00:05:48.709 --> 00:05:52.269 smiling for people who are watching as well. 00:05:52.970 --> 00:05:57.889 So N8N, I was calling it Nathan at the start. 00:05:57.949 --> 00:06:00.990 So I was like the N and the 8 Nathan, like it's 00:06:00.990 --> 00:06:04.430 somebody's name. Apparently I was wrong. I looked 00:06:04.430 --> 00:06:09.209 it up, obviously, as I do. So N8N is what they 00:06:09.209 --> 00:06:12.189 call a numeronym. I'm not sure if I pronounced 00:06:12.189 --> 00:06:14.930 it correctly in English. And it actually stands 00:06:14.930 --> 00:06:18.769 for nodemation. It's a little bit similar like 00:06:18.769 --> 00:06:22.509 Kubernetes and K8S, right? So they only use the 00:06:22.509 --> 00:06:24.430 first and last letter and then replace all the 00:06:24.430 --> 00:06:26.930 positions between with the amount of positions 00:06:26.930 --> 00:06:30.930 which were covered. That's what K8S comes from. 00:06:31.370 --> 00:06:34.529 So yeah, while I was tempted to say Nathan, the 00:06:34.529 --> 00:06:37.550 readme says N8N. So I'm going to stick with that 00:06:37.550 --> 00:06:40.360 for now. So now that we have that out of the 00:06:40.360 --> 00:06:42.540 way. That's important. That's the important thing 00:06:42.540 --> 00:06:45.180 you got to learn. It is. It's like naming conventions, 00:06:45.500 --> 00:06:47.660 right? Everybody working in IT know that we can 00:06:47.660 --> 00:06:51.910 have meetings about that for hours. Yeah, sorry 00:06:51.910 --> 00:06:55.889 for that. So, yeah, like I said at the introduction, 00:06:56.170 --> 00:06:58.829 so the Microsoft default when it comes to, well, 00:06:58.910 --> 00:07:01.470 Sentinel playbooks specifically, but now also 00:07:01.470 --> 00:07:04.370 with the unified SOC experience where Sentinel 00:07:04.370 --> 00:07:07.410 has moved into the Defender portal, Logic Apps 00:07:07.410 --> 00:07:10.759 is still the default. There is, however, something 00:07:10.759 --> 00:07:13.860 new on the horizon, which became general available 00:07:13.860 --> 00:07:17.399 quite recently. And I will touch on that later 00:07:17.399 --> 00:07:20.540 in the episode. But Logic Apps was like your 00:07:20.540 --> 00:07:23.560 default. And I always had a love -hate relationship 00:07:23.560 --> 00:07:27.100 with Logic Apps. And I think everybody who worked 00:07:27.100 --> 00:07:31.470 with them recognizes this. It's very... Ease 00:07:31.470 --> 00:07:33.850 of use. You can start with it quite easily. It 00:07:33.850 --> 00:07:36.350 has a nice graphical overview. It's very low 00:07:36.350 --> 00:07:38.910 code, like you said, and you can tie things together 00:07:38.910 --> 00:07:41.629 and it looks quite easy. But when you have to 00:07:41.629 --> 00:07:45.230 run through some more complex tasks of running 00:07:45.230 --> 00:07:48.629 through loops, changing data types, changing 00:07:48.629 --> 00:07:51.329 arrays and integers and strings and putting them 00:07:51.329 --> 00:07:54.569 together, it gets quite complex quite easily. 00:07:54.870 --> 00:07:58.310 And since we run a SOC for a lot of different 00:07:58.310 --> 00:08:01.129 customers, we like to do... infrastructure as 00:08:01.129 --> 00:08:04.230 code as much as possible as well. And with the 00:08:04.230 --> 00:08:06.709 ARM template way of deploying logic apps, you 00:08:06.709 --> 00:08:09.910 have to put the entire workflow as a concatenated 00:08:09.910 --> 00:08:13.509 string in the template. It's ugly. Then it's 00:08:13.509 --> 00:08:16.769 difficult to replace certain parameters for each 00:08:16.769 --> 00:08:20.920 different customer in this regard. And we had 00:08:20.920 --> 00:08:23.699 like, if we have one automation for a certain 00:08:23.699 --> 00:08:26.720 task and we have 200 customers, we have 200 logic 00:08:26.720 --> 00:08:29.439 apps to deploy. And that's also not very handy 00:08:29.439 --> 00:08:32.220 when it comes to an MSSP perspective. But obviously 00:08:32.220 --> 00:08:37.039 that's MSSP specific, but still. Also troubleshooting 00:08:37.039 --> 00:08:40.840 and debugging was always a pain in my opinion. 00:08:41.539 --> 00:08:44.779 You're endlessly going through runs and trial 00:08:44.779 --> 00:08:48.559 and error to figure out what's going on, changing 00:08:48.559 --> 00:08:51.029 something. then running it again, waiting for 00:08:51.029 --> 00:08:53.629 seconds or minutes even, and then see what went 00:08:53.629 --> 00:08:57.789 wrong now this time. Not very useful when you're 00:08:57.789 --> 00:09:00.269 going to use this as a skill. But still, it's 00:09:00.269 --> 00:09:03.049 very easy to start with. So I don't want to give 00:09:03.049 --> 00:09:05.929 Logic Apps too much disrespect in that regard. 00:09:06.070 --> 00:09:11.549 But it was lacking in certain ways. So yeah, 00:09:11.669 --> 00:09:16.629 here comes N8n. And like I said, a lot of quality 00:09:16.629 --> 00:09:20.100 of life improvements to start with. I'm not sure. 00:09:20.139 --> 00:09:22.279 Is that the sound on your side? I saw some birds 00:09:22.279 --> 00:09:28.399 making some noise on your end. I hear birds. 00:09:28.539 --> 00:09:33.059 Is it my side? No worries. It's okay. We're a 00:09:33.059 --> 00:09:34.960 little bit in Australia here with the listeners. 00:09:35.080 --> 00:09:38.610 That's great. So a couple of quality of life 00:09:38.610 --> 00:09:41.509 improvements with N8n, which I really like. For 00:09:41.509 --> 00:09:44.149 example, you can pin data. It looks a little 00:09:44.149 --> 00:09:45.809 bit similar when you look at the show notes. 00:09:45.889 --> 00:09:48.929 I put a couple of animated GIFs in there where 00:09:48.929 --> 00:09:51.110 you can see how it looks. It looks quite similar 00:09:51.110 --> 00:09:53.190 to Logic Apps. You have those nodes and you can 00:09:53.190 --> 00:09:56.789 tie them together with inputs and outputs. But 00:09:56.789 --> 00:09:59.470 with N8n, you can actually pin data. So without 00:09:59.470 --> 00:10:01.850 running the entire workflow again, you can copy 00:10:01.850 --> 00:10:06.330 -paste an output from one node and pin it to 00:10:06.330 --> 00:10:08.690 the input of the next node, for example. And 00:10:08.690 --> 00:10:11.129 you can only run that part multiple times if 00:10:11.129 --> 00:10:13.649 you like. And if you're, for example, working 00:10:13.649 --> 00:10:16.230 in a development environment where you don't 00:10:16.230 --> 00:10:19.509 have real live data, you can just make up your 00:10:19.509 --> 00:10:21.990 own data, put it at the input of the workflow, 00:10:22.149 --> 00:10:24.590 pin it, and then run the workflow from there 00:10:24.590 --> 00:10:27.200 so you can fully test it. without having to attach 00:10:27.200 --> 00:10:29.500 it to anything for example, which is really useful. 00:10:31.070 --> 00:10:32.929 The other thing I really like is the way that 00:10:32.929 --> 00:10:35.850 you can have sub workflows. So when you have 00:10:35.850 --> 00:10:37.970 a lot of procedures and a lot of steps going 00:10:37.970 --> 00:10:40.210 through, like, I don't know, requesting a token, 00:10:40.409 --> 00:10:43.149 a bearer token for an environment, you can have 00:10:43.149 --> 00:10:45.669 a separate workflow for that and call that workflow 00:10:45.669 --> 00:10:48.549 from another workflow. Or if you want to do some 00:10:48.549 --> 00:10:50.789 remediation steps on an identity, I don't know, 00:10:50.809 --> 00:10:53.210 let's say reset somebody's password. You write 00:10:53.210 --> 00:10:56.090 it once, you create a sub workflow for it. And 00:10:56.090 --> 00:10:59.230 every time you need to access that, you can call 00:10:59.230 --> 00:11:01.210 that sub workflow from. any other workflows. 00:11:01.350 --> 00:11:03.769 So you can create those really nested layers 00:11:03.769 --> 00:11:06.570 of workflows, calling other workflows, and you 00:11:06.570 --> 00:11:09.870 can reuse a lot of routines much more easily, 00:11:10.090 --> 00:11:12.909 which is also great. And one thing everybody 00:11:12.909 --> 00:11:14.990 who worked with Logic Apps will probably recognize 00:11:14.990 --> 00:11:18.370 this. You can actually move around nodes. You 00:11:18.370 --> 00:11:20.490 can actually multiple select. You can drag and 00:11:20.490 --> 00:11:23.389 drop a selection box, take multiple nodes, move 00:11:23.389 --> 00:11:25.970 them around, copy and paste them even, and attach 00:11:25.970 --> 00:11:28.809 them to different ways. And this was always very 00:11:28.809 --> 00:11:31.279 hard with Logic Apps. If you made something and 00:11:31.279 --> 00:11:33.559 you want to switch things around, it probably 00:11:33.559 --> 00:11:35.879 wouldn't allow you to drag and drop it to a different 00:11:35.879 --> 00:11:37.639 place in the workflow because the inputs and 00:11:37.639 --> 00:11:40.259 outputs didn't match anymore. Then you thought 00:11:40.259 --> 00:11:42.820 you would be smart and going into the code view 00:11:42.820 --> 00:11:45.799 of a logic app and copy paste things around manually. 00:11:45.960 --> 00:11:49.299 And everybody who tried that knows that you'll 00:11:49.299 --> 00:11:51.620 probably make a bigger mess of it that way because 00:11:51.620 --> 00:11:53.919 you're messing up all the run after properties 00:11:53.919 --> 00:11:55.940 and you have to manually switch those around 00:11:55.940 --> 00:11:58.860 while you're in code view. You cannot switch. 00:11:59.019 --> 00:12:01.399 back to the designer view. So you're always guessing 00:12:01.399 --> 00:12:03.159 a little bit of what did the workflow actually 00:12:03.159 --> 00:12:06.559 look like, open a new tab, et cetera. It's fun. 00:12:07.399 --> 00:12:10.820 Let's say that. Another thing I really like about 00:12:10.820 --> 00:12:13.159 N8N, everybody who's listening for the last couple 00:12:13.159 --> 00:12:16.179 of episodes know that I'm a big fan of Claude 00:12:16.179 --> 00:12:20.570 and Claude Cote. n8n as an mcp server so i can 00:12:20.570 --> 00:12:23.889 just attach claude to my n8n environment and 00:12:23.889 --> 00:12:27.129 let him help me create some workflows based on 00:12:27.129 --> 00:12:30.490 natural language and this really helped me especially 00:12:30.490 --> 00:12:33.110 at the beginning where i didn't fully understand 00:12:33.110 --> 00:12:37.610 how n8n worked and how data was processed i just 00:12:37.610 --> 00:12:40.129 came up with an idea let claude make something 00:12:40.129 --> 00:12:42.629 and i can adjust it afterwards to my liking for 00:12:42.629 --> 00:12:48.009 example um It is a free edition of N8N. So, Chris, 00:12:48.090 --> 00:12:49.850 you mentioned at the start of this episode that 00:12:49.850 --> 00:12:54.769 you were looking into this one day. The community 00:12:54.769 --> 00:12:57.950 edition, as it is called, is free of use. You 00:12:57.950 --> 00:13:00.269 need to host it yourself in a Docker container. 00:13:00.429 --> 00:13:02.809 So that's the only downside. You have to put 00:13:02.809 --> 00:13:05.350 up some infrastructure for it. There are some 00:13:05.350 --> 00:13:08.070 other downsides, like you don't have any Git 00:13:08.070 --> 00:13:12.820 integration. That seems like a big one, right? 00:13:12.899 --> 00:13:15.820 If you're wanting to do sort of as -code stuff 00:13:15.820 --> 00:13:18.100 and you can't have source control, that's a bit 00:13:18.100 --> 00:13:19.980 of a problem, I guess. Yeah, but then at least 00:13:19.980 --> 00:13:23.059 you can try it out to see if you can build the 00:13:23.059 --> 00:13:25.460 stuff you're having in your head before you commit 00:13:25.460 --> 00:13:28.080 to a paid environment. While we're talking about 00:13:28.080 --> 00:13:30.600 browsing, let me scroll down to my notes at the 00:13:30.600 --> 00:13:35.100 end. It's not that expensive either. I think 00:13:35.100 --> 00:13:37.019 it will be a little bit more expensive than Logic 00:13:37.019 --> 00:13:39.279 Apps because Logic Apps are dirt cheap, I guess. 00:13:39.460 --> 00:13:43.039 You only pay for every node that you run. And 00:13:43.039 --> 00:13:45.980 it's, I don't know, one thousandth of a cent 00:13:45.980 --> 00:13:48.399 of a euro or something like that per time. It's 00:13:48.399 --> 00:13:51.039 really cheap. So even if you run these thousand 00:13:51.039 --> 00:13:54.049 times a month, you will... probably pay, I don't 00:13:54.049 --> 00:13:57.610 know, less than 10 euros or $10 a month in fees 00:13:57.610 --> 00:13:59.789 for Logic Apps. So they're really cheap. With 00:13:59.789 --> 00:14:03.070 N8n, you buy a license, of course. They have 00:14:03.070 --> 00:14:06.330 a starter license for 20 euro or dollar annually. 00:14:06.570 --> 00:14:10.210 And it goes up until the, let me see, they have 00:14:10.210 --> 00:14:14.309 a business license for $700 a year, which I think 00:14:14.309 --> 00:14:17.649 is still reasonable if you use it for corporate 00:14:17.649 --> 00:14:19.649 enterprise, right? And this gives you an SLA, 00:14:19.889 --> 00:14:22.720 a Git integration, a lot of stuff. Obviously, 00:14:22.759 --> 00:14:24.940 you're limited still in a couple of ways, like 00:14:24.940 --> 00:14:27.340 the amount of executions you can do per month. 00:14:27.379 --> 00:14:30.379 But I think with a business, it's 40 ,000 executions 00:14:30.379 --> 00:14:32.620 a month. So if you're surpassing that, you have 00:14:32.620 --> 00:14:34.600 to go to the enterprise license, but then you're 00:14:34.600 --> 00:14:37.200 probably also using it heavily. We have the enterprise 00:14:37.200 --> 00:14:39.879 license, but again, we're an MSSP and we're doing 00:14:39.879 --> 00:14:42.100 this a lot across a lot of different customers. 00:14:42.179 --> 00:14:45.559 So it makes sense, I guess. But it's not crazy 00:14:45.559 --> 00:14:49.820 expensive. Another thing I like is the integration 00:14:49.820 --> 00:14:52.080 with a lot of AI stuff. So there are a lot of 00:14:52.080 --> 00:14:55.740 built -in AI functionality and features, which 00:14:55.740 --> 00:14:57.679 is always great. With Logic Apps, you have to 00:14:57.679 --> 00:15:01.500 build a lot of that custom. We use AI Foundry 00:15:01.500 --> 00:15:07.009 in our own Azure region for some AI stuff. Things 00:15:07.009 --> 00:15:10.970 like when we receive a very cryptic message coming 00:15:10.970 --> 00:15:13.809 out of Defender for EASM or from Apollo Alto 00:15:13.809 --> 00:15:16.769 or FortiGate to Firewall, for example, they might 00:15:16.769 --> 00:15:19.970 only mention a CVE number and maybe a source 00:15:19.970 --> 00:15:23.980 and a destination IP. throw it into an AI foundry 00:15:23.980 --> 00:15:27.220 with a very specific prompt with how we expect 00:15:27.220 --> 00:15:30.059 the input and output to be. And the AI can help 00:15:30.059 --> 00:15:33.220 us explain the specific alert. And that helps 00:15:33.220 --> 00:15:35.679 us to enrich the incidents and our communication 00:15:35.679 --> 00:15:39.100 towards our customers, for example. I also did 00:15:39.100 --> 00:15:42.460 a lot with some fully automated triage when an 00:15:42.460 --> 00:15:46.179 incident came in with an identity running in 00:15:46.179 --> 00:15:49.220 Entra or Active Directory. We have a whole automated 00:15:49.220 --> 00:15:52.720 triage step where we check MFA, check last sign 00:15:52.720 --> 00:15:55.159 -ins, check agent versions of recent sign -ins, 00:15:55.240 --> 00:15:58.419 check what kind of MFA was applied, if there 00:15:58.419 --> 00:16:01.360 were some MFA denies in the past, a lot of variables 00:16:01.360 --> 00:16:03.019 like that. So we have a whole workflow going 00:16:03.019 --> 00:16:06.399 on where we can trust if an identity was involved 00:16:06.399 --> 00:16:10.120 in an incident. we can put a certainty on it 00:16:10.120 --> 00:16:16.379 if the identity was abused or probably breached 00:16:16.379 --> 00:16:19.059 or not. Stuff like that. So yeah, really good 00:16:19.059 --> 00:16:23.009 stuff. For people listening in the EU... N8n 00:16:23.009 --> 00:16:26.789 is a German company. They run out of Berlin. 00:16:27.110 --> 00:16:29.830 And well, obviously, if you self -host it, you 00:16:29.830 --> 00:16:32.909 can host it wherever you want. And if you use 00:16:32.909 --> 00:16:36.809 the cloud edition of N8n, they host it in Europe 00:16:36.809 --> 00:16:39.570 by default. They don't have an elaborate location 00:16:39.570 --> 00:16:42.070 picker as you're used to Azure. So they have 00:16:42.070 --> 00:16:45.230 like Europe as a boundary. They do specify in 00:16:45.230 --> 00:16:46.809 which countries they have everything running. 00:16:47.450 --> 00:16:49.549 But again, if this is really a big concern, you 00:16:49.549 --> 00:16:51.269 can even host it yourself. That's how we do it. 00:16:51.309 --> 00:16:53.559 We have it hosted. it ourselves, completely private 00:16:53.559 --> 00:16:56.720 in Docker containers as well. So nobody can touch 00:16:56.720 --> 00:16:59.379 it. But yeah, it's good to know that a company 00:16:59.379 --> 00:17:03.840 like this puts some effort in these details as 00:17:03.840 --> 00:17:06.839 well. The licensing seems to be really well tiered 00:17:06.839 --> 00:17:08.859 though. So like you said, you can start really 00:17:08.859 --> 00:17:10.940 small with a free license and test out some stuff. 00:17:11.079 --> 00:17:13.380 And as you grow, you can eventually then get 00:17:13.380 --> 00:17:16.000 to enterprise where you're hosting your own thing 00:17:16.000 --> 00:17:18.000 and blah, blah, blah. So that's cool. That's 00:17:18.000 --> 00:17:19.599 cool to see. It doesn't have to be all or nothing 00:17:19.599 --> 00:17:22.740 to begin with, which I like. Yeah, no, that's 00:17:22.740 --> 00:17:25.180 true. That's completely true. When it comes to 00:17:25.180 --> 00:17:29.000 using N8n for workflows for SOAR, for Sentinel 00:17:29.000 --> 00:17:31.819 and Defender integration, people listening might 00:17:31.819 --> 00:17:36.579 already be asking or wondering this, how are 00:17:36.579 --> 00:17:39.700 we going to integrate N8n in that workflow? Because 00:17:39.700 --> 00:17:42.160 Logic Apps is very neatly integrated, right? 00:17:42.240 --> 00:17:44.259 So you have like the automation rule in Sentinel, 00:17:44.359 --> 00:17:47.339 for example, or you call a Logic App from the 00:17:47.339 --> 00:17:50.500 Defender portal nowadays, and it's completely 00:17:50.500 --> 00:17:54.759 integrated. With N8n, we cannot... trigger a 00:17:54.759 --> 00:17:57.160 workflow straight from the defender portal for 00:17:57.160 --> 00:17:59.680 example well a couple of things to do that one 00:17:59.680 --> 00:18:02.059 you could still use an automation rule as you 00:18:02.059 --> 00:18:04.660 were used to and then call a very thin logic 00:18:04.660 --> 00:18:08.220 app which calls your webhook from your n8n workflow 00:18:08.220 --> 00:18:11.700 that is one way to work around this depending 00:18:11.700 --> 00:18:14.599 on the on your use case i guess at least then 00:18:14.599 --> 00:18:17.519 it's fully automatically triggered yeah then 00:18:17.519 --> 00:18:19.299 you have to little build a little bit of additional 00:18:19.299 --> 00:18:23.259 plumbing that way another way to it to do it 00:18:23.259 --> 00:18:25.240 the other way around to use i don't know some 00:18:25.240 --> 00:18:27.980 kind of schedule trigger from n8n and use the 00:18:27.980 --> 00:18:31.519 the graph get api to pull in incidents pull in 00:18:31.519 --> 00:18:34.180 details and then take it from there and you can 00:18:34.180 --> 00:18:38.180 obviously patch through the the same api to update 00:18:38.180 --> 00:18:41.240 the incidents and enrich them in that way And 00:18:41.240 --> 00:18:43.400 there's obviously the Sentinel ARM API still, 00:18:43.619 --> 00:18:46.339 but you have to be very careful with that because 00:18:46.339 --> 00:18:48.519 as we mentioned a couple of times earlier during 00:18:48.519 --> 00:18:51.519 this podcast, is that Sentinel will retire from 00:18:51.519 --> 00:18:57.900 the Azure portal March 31 next year. So we don't 00:18:57.900 --> 00:18:59.900 know for sure how that would look like. I can 00:18:59.900 --> 00:19:02.420 imagine that the log analytics part will still 00:19:02.420 --> 00:19:04.880 be log analytics in Azure because, well, obviously 00:19:04.880 --> 00:19:08.279 that's an Azure specific resource, but I think 00:19:08.279 --> 00:19:11.200 the Sentinel UI will disappear. Microsoft has 00:19:11.200 --> 00:19:13.519 a transition guide and warning everybody to move 00:19:13.519 --> 00:19:16.859 away as much from Sentinel stuff where you're 00:19:16.859 --> 00:19:20.640 relying on it. Also, they mentioned that the 00:19:20.640 --> 00:19:23.640 Sentinel API will stay for analytic rule, for 00:19:23.640 --> 00:19:26.160 example, and automation rules. But the incidents 00:19:26.160 --> 00:19:28.799 and alerts, they already warn you to not pull 00:19:28.799 --> 00:19:31.539 them in from the Sentinel ARM API, but use the 00:19:31.539 --> 00:19:33.980 Graph API instead. So that's something I wanted 00:19:33.980 --> 00:19:38.119 to drop here as well. Be aware that March 31st 00:19:38.119 --> 00:19:41.039 next year. will be the end of life for Sentinel 00:19:41.039 --> 00:19:44.000 as we know it in the Azure portal. And yeah, 00:19:44.119 --> 00:19:48.099 I would advise to use Graph API for that reason. 00:19:48.759 --> 00:19:52.400 Well, we already covered costs. Again, please 00:19:52.400 --> 00:19:54.599 look at the show notes. I put a lot of GIFs in 00:19:54.599 --> 00:19:56.880 there where you can see the sub workflows, some 00:19:56.880 --> 00:19:59.640 quality of life things like data pinning and 00:19:59.640 --> 00:20:02.420 moving around the nodes. It's really, yeah, some 00:20:02.420 --> 00:20:05.759 next level stuff for you when you compare it 00:20:05.759 --> 00:20:11.009 to Logic Apps, I'd say. I was going to say, it 00:20:11.009 --> 00:20:13.690 definitely looks like it takes that type of stuff 00:20:13.690 --> 00:20:16.309 to the next level, which is really cool. Yeah. 00:20:16.650 --> 00:20:19.750 Yeah, and obviously you can still run code in 00:20:19.750 --> 00:20:23.029 Node in N8n. So you can run JavaScript and Python 00:20:23.029 --> 00:20:25.950 and all kinds of complex expressions. That's 00:20:25.950 --> 00:20:28.730 sometimes one of the downsides when I use Claude 00:20:28.730 --> 00:20:31.890 with the MCP server because Claude has a tendency 00:20:31.890 --> 00:20:35.109 to make things very complex, put a lot of logic 00:20:35.109 --> 00:20:37.549 in code in a Node, and then I don't understand 00:20:37.549 --> 00:20:39.990 what the Node is actually doing because I'm not 00:20:39.990 --> 00:20:43.009 a JavaScript expert. So I really have to deliberately 00:20:43.009 --> 00:20:47.289 tell him not to do that. when not strictly needed. 00:20:47.450 --> 00:20:51.710 So, yeah. I promised a little bit of a Microsoft 00:20:51.710 --> 00:20:55.369 angle to round off my topic for this time. We're 00:20:55.369 --> 00:20:58.430 obviously not a 100 % Microsoft podcast per se, 00:20:58.569 --> 00:21:02.309 but still we're like big Microsoft fans of the 00:21:02.309 --> 00:21:04.670 Microsoft security product. And in this case, 00:21:04.690 --> 00:21:08.369 we deviated away from Logic Apps for good reasons, 00:21:08.390 --> 00:21:11.049 I guess. But Microsoft is also working on some 00:21:11.049 --> 00:21:16.359 new things. And Microsoft is handling playbooks 00:21:16.359 --> 00:21:18.240 a little bit differently, perhaps in the future. 00:21:19.279 --> 00:21:22.640 They have now, and well, it won't surprise you, 00:21:22.680 --> 00:21:25.980 an AI -based playbook generator. But hold on, 00:21:26.039 --> 00:21:29.720 hold on. It's not as bad as it sounds. It does 00:21:29.720 --> 00:21:32.819 not generate Logic Apps for you, but they use 00:21:32.819 --> 00:21:36.640 Klein, and this is an open source solution. It 00:21:36.640 --> 00:21:39.759 stands for CLI and Editor. I looked it up, of 00:21:39.759 --> 00:21:42.579 course. And Klein will actually... generates 00:21:42.579 --> 00:21:45.779 a Python playbook for you based on natural language. 00:21:46.980 --> 00:21:49.920 So they announced this in, it went in preview 00:21:49.920 --> 00:21:52.640 earlier this year in February and in May already 00:21:52.640 --> 00:21:54.660 of this year, it went GA. So you can actually 00:21:54.660 --> 00:21:57.539 start using it right now. And so you describe 00:21:57.539 --> 00:22:00.220 in natural language a flow, like for example, 00:22:00.220 --> 00:22:03.019 send me an email when this or that happens or 00:22:03.019 --> 00:22:05.259 this type of incident happens. That's the example 00:22:05.259 --> 00:22:07.940 in the documentation as well. And they will first 00:22:07.940 --> 00:22:11.339 plan out and show you a diagram of a visual diagram. 00:22:11.599 --> 00:22:13.980 of what the playbook will actually do. You can 00:22:13.980 --> 00:22:16.759 adjust to it and then you can say, okay, let's 00:22:16.759 --> 00:22:19.380 act on it. Let's make this final. And then it 00:22:19.380 --> 00:22:22.660 will finalize the Python script and it will save 00:22:22.660 --> 00:22:27.990 it as a playbook. And obviously it's 100 % code 00:22:27.990 --> 00:22:30.950 generated. And the great thing is it does not 00:22:30.950 --> 00:22:33.910 require a security co -pilot license and it does 00:22:33.910 --> 00:22:37.410 not require any SEOs. You can just start using 00:22:37.410 --> 00:22:39.930 it without any additional costs. So that's a 00:22:39.930 --> 00:22:42.769 first, I guess, in AI world, right? That is pretty 00:22:42.769 --> 00:22:45.930 cool. You know, I don't know about you, but... 00:22:46.539 --> 00:22:48.279 I'm starting to think that I really need to start 00:22:48.279 --> 00:22:50.299 spending more time learning Python, right? Because 00:22:50.299 --> 00:22:52.960 like everything in this new AI world is Python. 00:22:53.099 --> 00:22:56.019 And I've always, we've obviously, we've had Python 00:22:56.019 --> 00:22:58.819 support in Azure for a long time, right? With 00:22:58.819 --> 00:23:02.119 Azure CLI and, you know, even automation runbooks, 00:23:02.319 --> 00:23:05.279 you could always run Python runbooks. But PowerShell 00:23:05.279 --> 00:23:07.619 has always been there as a first -class citizen. 00:23:08.440 --> 00:23:10.559 But man, I tell you what, everything I look at 00:23:10.559 --> 00:23:12.880 these days and every tool I look at these days, 00:23:12.920 --> 00:23:15.420 right? And I think it's very... evident when 00:23:15.420 --> 00:23:18.779 something has been um deliberately sort of vibe 00:23:18.779 --> 00:23:21.960 coded is because it runs as a python script um 00:23:21.960 --> 00:23:24.559 you know it's it seems to be the native you know 00:23:24.559 --> 00:23:27.779 like um all these llms output every documentation 00:23:27.779 --> 00:23:31.559 as a as markdown um and i love markdown so don't 00:23:31.559 --> 00:23:34.480 get me wrong but it seems like the the code language 00:23:34.480 --> 00:23:37.920 of choice for anything ai related is python um 00:23:37.920 --> 00:23:40.819 and so maybe i need to take that as a sign and 00:23:40.819 --> 00:23:43.480 i mean i you know i can find my way around python 00:23:43.480 --> 00:23:46.519 and and javascript if i need to but it's not 00:23:46.519 --> 00:23:49.160 my preferred thing like if i'm gonna code up 00:23:49.160 --> 00:23:50.940 something, usually PowerShell is where I go, 00:23:51.000 --> 00:23:54.039 right? So maybe that's a lesson for us for another 00:23:54.039 --> 00:23:58.000 show is starting to dig into some of the nuances 00:23:58.000 --> 00:24:02.180 of Python. But anyway, before I distract us from 00:24:02.180 --> 00:24:05.200 what we're talking about here, there was an observation 00:24:05.200 --> 00:24:08.819 worth making, I guess. Yeah, and this is Python 00:24:08.819 --> 00:24:11.700 only for now. I don't know if Microsoft is working 00:24:11.700 --> 00:24:14.240 on any different languages, but it's only Python. 00:24:14.460 --> 00:24:16.619 So if you understand Python, it will definitely 00:24:16.619 --> 00:24:19.119 help if you want to fine tune some bits and pieces 00:24:19.119 --> 00:24:22.380 of the playbook, of course. But again, it's really 00:24:22.380 --> 00:24:25.119 emphasizing on natural language. You'll see the 00:24:25.119 --> 00:24:27.500 visual representation of the workflow first, 00:24:27.619 --> 00:24:30.759 and you can obviously prompt and add to it if 00:24:30.759 --> 00:24:32.880 you want to adjust things before it gets completely 00:24:32.880 --> 00:24:36.279 automatically generated. There are some limitations. 00:24:36.680 --> 00:24:40.299 As always, there's an alert input only. You cannot 00:24:40.299 --> 00:24:43.220 trigger it on incidents or entities right now. 00:24:43.319 --> 00:24:47.019 Might come, I don't know. There's no playbook 00:24:47.019 --> 00:24:49.180 to playbook calls. So every playbook is very 00:24:49.180 --> 00:24:52.660 static. It's just single playbook. So again, 00:24:52.720 --> 00:24:54.440 it depends a little bit on what you're working 00:24:54.440 --> 00:24:57.680 on. There's a limit of 100 playbooks per tenant 00:24:57.680 --> 00:25:01.140 and each playbook cannot exceed 5 ,000 lines 00:25:01.140 --> 00:25:04.240 of code, which is quite a lot, I guess. And there's 00:25:04.240 --> 00:25:07.339 a max of 10 minutes. runtime. And there is also 00:25:07.339 --> 00:25:10.140 a max on the amount of AI tokens you can spend 00:25:10.140 --> 00:25:12.799 per day for each tenant for generating these. 00:25:13.680 --> 00:25:17.220 So obviously Microsoft is preventing you for 00:25:17.220 --> 00:25:20.740 using the playbook UI for vibe coding your private 00:25:20.740 --> 00:25:23.339 projects, I guess, or something like that. I 00:25:23.339 --> 00:25:25.740 see some funny memes going around with the people 00:25:25.740 --> 00:25:31.039 abusing support bots from all kinds of famous 00:25:31.039 --> 00:25:34.420 websites in the world to generate codes for them, 00:25:34.480 --> 00:25:36.380 for example. interesting one on mcdonald's but 00:25:36.380 --> 00:25:37.599 yeah i mean you don't know how many of these 00:25:37.599 --> 00:25:39.559 are actually real or not but i wouldn't be surprised 00:25:39.559 --> 00:25:42.880 right it's pretty funny pretty funny the only 00:25:42.880 --> 00:25:45.339 thing is there's no code validation so when the 00:25:45.339 --> 00:25:47.799 playbook shows up in a visual way and you say 00:25:47.799 --> 00:25:50.279 okay this looks good it generates you have to 00:25:50.279 --> 00:25:53.039 verify the correctness yourself Again, this is 00:25:53.039 --> 00:25:55.099 early days still. It is generally available, 00:25:55.279 --> 00:25:58.420 but I can imagine Microsoft will be optimized 00:25:58.420 --> 00:26:00.779 the heck out of this and add a lot of new features 00:26:00.779 --> 00:26:03.660 in the future. So yeah, and again, it's there. 00:26:03.740 --> 00:26:07.359 It's free. Try it out. And yeah, maybe this is 00:26:07.359 --> 00:26:09.799 already a great addition to Logic Apps in your 00:26:09.799 --> 00:26:12.319 environment. yeah and if you really need to go 00:26:12.319 --> 00:26:15.039 to the that next level n8n that's what you want 00:26:15.039 --> 00:26:17.019 to be looking at so very cool and then you can 00:26:17.019 --> 00:26:19.500 use natural language with claude on the mcp server 00:26:19.500 --> 00:26:21.640 and then you're doing workflows like a real pro 00:26:21.640 --> 00:26:26.279 i would say very nice that's very cool i um the 00:26:26.279 --> 00:26:28.140 stuff that you build man it always it always 00:26:28.140 --> 00:26:32.119 uh amazes me how you yeah it's very very cool 00:26:32.119 --> 00:26:33.579 so thanks for sharing that one with us i know 00:26:33.579 --> 00:26:34.759 you've been working on this stuff for a long 00:26:34.759 --> 00:26:36.740 time so it's nice that we can get a bit of a 00:26:36.740 --> 00:26:41.579 taste to the inner workings of the best MSP in 00:26:41.579 --> 00:26:46.319 Europe, right? If not the world, who knows? Well, 00:26:46.460 --> 00:26:49.799 the thing is, I also admit that I'm in a little 00:26:49.799 --> 00:26:52.079 bit of a niche that way, right? So like these 00:26:52.079 --> 00:26:54.500 workflows, I can imagine that most companies 00:26:54.500 --> 00:26:56.160 who have their own SOC and their own security 00:26:56.160 --> 00:26:59.180 division won't go through as much length as we 00:26:59.180 --> 00:27:02.200 do to automate the crap out of this, but we have 00:27:02.200 --> 00:27:05.259 to because otherwise it's not scalable. But still, 00:27:05.359 --> 00:27:08.430 I think N8N is such a great... tool you i know 00:27:08.430 --> 00:27:11.130 people uh colleagues of mine are now also using 00:27:11.130 --> 00:27:13.349 it privately to automate a lot of home automation 00:27:13.349 --> 00:27:16.609 and home assistant playbooks as well so it's 00:27:16.609 --> 00:27:19.230 not only security if you want to look into this 00:27:19.230 --> 00:27:23.390 and to be honest that's i think one of the the 00:27:23.390 --> 00:27:26.920 reasons i was looking into it before was If I 00:27:26.920 --> 00:27:28.759 remember correctly, it was for podcast automation. 00:27:29.059 --> 00:27:31.460 I was looking to do some automated stuff with 00:27:31.460 --> 00:27:35.619 RSS feeds and things like that on the Cloud Architects 00:27:35.619 --> 00:27:39.359 podcast a year or so ago. So yeah, it certainly 00:27:39.359 --> 00:27:41.079 didn't have the security angle on it. It was 00:27:41.079 --> 00:27:43.579 just something I was messing around with in that 00:27:43.579 --> 00:27:48.640 limited spare time that I have. Yeah, very cool. 00:27:48.759 --> 00:27:52.230 Very cool. So tell me what you brought to this 00:27:52.230 --> 00:27:54.549 episode. Yeah, I've been thinking a little bit 00:27:54.549 --> 00:27:56.609 about dynamic groups. And, you know, as I said 00:27:56.609 --> 00:27:58.990 at the sort of the start of the show, I think, 00:27:58.990 --> 00:28:04.029 you know, we are seeing sort of changes and announcements 00:28:04.029 --> 00:28:06.890 for changes to things that get sort of slipped 00:28:06.890 --> 00:28:11.180 in to, you know. they get announced, they don't 00:28:11.180 --> 00:28:14.220 really get a lot of press, and oftentimes there's 00:28:14.220 --> 00:28:16.839 not a lot of runway on them either. So, you know, 00:28:16.839 --> 00:28:18.940 things are starting to catch customers out because 00:28:18.940 --> 00:28:22.740 a change is made and you potentially have things 00:28:22.740 --> 00:28:25.279 in your environment that relies on it, right? 00:28:25.400 --> 00:28:27.900 So I've been thinking about dynamic groups a 00:28:27.900 --> 00:28:32.079 little bit. There's a few things that I wanted 00:28:32.079 --> 00:28:35.539 to kind of talk about, you know, that sort of 00:28:35.539 --> 00:28:39.630 all... are related to dynamic groups. Probably 00:28:39.630 --> 00:28:41.690 the biggest one, though, is I wanted to talk 00:28:41.690 --> 00:28:45.309 a little bit about a change that's happening 00:28:45.309 --> 00:28:48.309 in November. So, you know, we all create these 00:28:48.309 --> 00:28:50.410 dynamic groups in our environments, and I would 00:28:50.410 --> 00:28:53.809 expect, you know, in a lot of environments, you 00:28:53.809 --> 00:28:55.670 have multiple administrators that sort of log 00:28:55.670 --> 00:28:58.089 into Entry, they create things, and those groups, 00:28:58.150 --> 00:29:01.400 they're just there, you know. They do what they 00:29:01.400 --> 00:29:02.980 need to do, so no one ever goes back to look 00:29:02.980 --> 00:29:05.400 at them, right, because they work and you just 00:29:05.400 --> 00:29:10.599 forget about them. Well, coming on the 3rd of 00:29:10.599 --> 00:29:16.180 November, the member of sort of property or search 00:29:16.180 --> 00:29:18.900 filter, I guess, for dynamic groups is being 00:29:18.900 --> 00:29:23.250 retired. You know, this has been in preview. 00:29:23.390 --> 00:29:25.430 I think it's been in like public preview for 00:29:25.430 --> 00:29:27.769 like four years or something like that. And it's 00:29:27.769 --> 00:29:31.890 not actually going there. It's just getting retired. 00:29:33.329 --> 00:29:35.490 It's sort of the closest thing that we have in 00:29:35.490 --> 00:29:39.710 Entra to nested groups. So essentially you can 00:29:39.710 --> 00:29:42.769 build a dynamic group by looking at the group 00:29:42.769 --> 00:29:46.109 membership of other groups, right? And so what's 00:29:46.109 --> 00:29:49.099 going to end up happening is that. capability 00:29:49.099 --> 00:29:51.759 is going away. But the challenge here is that 00:29:51.759 --> 00:29:54.819 it's not going to stop your dynamic groups from 00:29:54.819 --> 00:29:57.359 working and you're not going to get an error. 00:29:58.460 --> 00:30:03.480 All that will happen is any groups or sort of 00:30:03.480 --> 00:30:06.240 dynamic group memberships or dynamic administrative 00:30:06.240 --> 00:30:09.940 unit memberships, or if you manage, do entitlement 00:30:09.940 --> 00:30:11.720 management through auto -assignment policies 00:30:11.720 --> 00:30:17.359 and those policies you use member of as an assignment 00:30:17.359 --> 00:30:19.869 filter, Those things are just going to sort of 00:30:19.869 --> 00:30:22.069 remain static. They're going to sort of stay, 00:30:22.190 --> 00:30:24.509 the group membership will stay where it was on 00:30:24.509 --> 00:30:27.549 that day. So, you know, any new changes or deletions 00:30:27.549 --> 00:30:29.089 or things are just not going to get actioned, 00:30:29.089 --> 00:30:34.009 right? So I got to say, I think that a lot of 00:30:34.009 --> 00:30:36.950 organizations will have at least a few of these 00:30:36.950 --> 00:30:38.970 in their environment. If you are using dynamic 00:30:38.970 --> 00:30:42.289 groups, it's a very easy way, especially if you're 00:30:42.289 --> 00:30:45.579 using Exchange on Pre or... Active Directory 00:30:45.579 --> 00:30:47.240 and you have on -prem infrastructure and using 00:30:47.240 --> 00:30:51.519 hybrid identity because you may be syncing things 00:30:51.519 --> 00:30:55.099 from on -prem and instead of restructuring all 00:30:55.099 --> 00:30:57.220 of the groups, the easiest way has just been 00:30:57.220 --> 00:30:59.119 to say, hey, we've already got these groups on 00:30:59.119 --> 00:31:02.210 -prem. If the user is a member of this group 00:31:02.210 --> 00:31:04.029 or that group or that group, add them to this 00:31:04.029 --> 00:31:07.250 new dynamic group. That is a fairly common pattern, 00:31:07.349 --> 00:31:09.569 I think. And so I do think that this is going 00:31:09.569 --> 00:31:12.769 to catch some folks out. It's got a fairly wide 00:31:12.769 --> 00:31:14.910 effect, right? So if you think about things like 00:31:14.910 --> 00:31:18.230 group -based licensing, perhaps, where you assign 00:31:18.230 --> 00:31:21.490 your E3 or E5 or E7 licenses based on group membership, 00:31:21.750 --> 00:31:24.869 oftentimes the group membership stuff is provisioned 00:31:24.869 --> 00:31:27.779 on -prem. And then the dynamic group that does 00:31:27.779 --> 00:31:30.940 the assignment is referencing an on -prem group, 00:31:31.220 --> 00:31:34.680 things like that. So that one, conditional access 00:31:34.680 --> 00:31:37.579 policies is another one, you know, access packages. 00:31:38.720 --> 00:31:40.339 I'd already mentioned sort of administrative 00:31:40.339 --> 00:31:43.140 units, things like that. These things are all 00:31:43.140 --> 00:31:45.299 sort of potentially impacted in your environment 00:31:45.299 --> 00:31:49.119 if you're using member of as a way to construct 00:31:49.119 --> 00:31:53.619 membership for a dynamic group. I've got some... 00:31:53.960 --> 00:31:56.799 some code um in the show notes there's some powershell 00:31:56.799 --> 00:31:59.779 uh it's not python sorry folks powershell uh 00:31:59.779 --> 00:32:03.240 to um to help you potentially identify some some 00:32:03.240 --> 00:32:06.240 you know administrative units or or um groups 00:32:06.240 --> 00:32:11.200 it uses graph so connect graph um or if you want 00:32:11.200 --> 00:32:13.359 to download Connect 365, you can use that to 00:32:13.359 --> 00:32:15.500 connect your graph session, and then you can 00:32:15.500 --> 00:32:19.259 do that through here. This will kind of help 00:32:19.259 --> 00:32:21.920 you identify sort of the scope of it in your 00:32:21.920 --> 00:32:23.460 environment, and then you can kind of decide 00:32:23.460 --> 00:32:25.980 what to do, right? I think the first step here 00:32:25.980 --> 00:32:27.819 is you really should go and take a look. Even 00:32:27.819 --> 00:32:31.819 if you don't think you have any, you may. So 00:32:31.819 --> 00:32:33.500 go and have a look and just do a bit of an inventory 00:32:33.500 --> 00:32:37.339 of any groups that are using member of rule. 00:32:38.829 --> 00:32:40.789 See what the group's actually controlling. Like, 00:32:40.809 --> 00:32:42.750 what is it doing? Is it licenses? Is it conditional 00:32:42.750 --> 00:32:45.250 access? Things like that. Is it even just app 00:32:45.250 --> 00:32:46.829 visibility, right? Because that's another one. 00:32:46.849 --> 00:32:51.210 If you're publishing, you know, enterprise apps 00:32:51.210 --> 00:32:54.329 to users, sometimes that's a way to do it as 00:32:54.329 --> 00:32:56.950 well is by based on that sort of member of group. 00:32:58.490 --> 00:33:00.750 And then. Basically, you're going to have to 00:33:00.750 --> 00:33:03.869 sort of build a treatment plan for each one of 00:33:03.869 --> 00:33:06.069 the groups that you find, right? Depending on 00:33:06.069 --> 00:33:08.049 what it's doing, you're going to have to rebuild 00:33:08.049 --> 00:33:11.589 these with attributes that are actually supported, 00:33:11.690 --> 00:33:15.130 right? So if you think about things like department 00:33:15.130 --> 00:33:18.470 or company or country or things like that, attributes 00:33:18.470 --> 00:33:20.849 that are maybe supported or even custom attributes. 00:33:22.170 --> 00:33:24.490 So this could be a bit of work if you have a 00:33:24.490 --> 00:33:26.670 lot of these in the environment. So go and check 00:33:26.670 --> 00:33:29.740 this out. November 3rd or 3rd of November is 00:33:29.740 --> 00:33:31.940 the day that the stuff stops working. So I'd 00:33:31.940 --> 00:33:34.740 say, you know, luckily there's no catastrophic 00:33:34.740 --> 00:33:37.900 house on fire situation, but stuff's going to 00:33:37.900 --> 00:33:39.779 stop working, or at least your group membership's 00:33:39.779 --> 00:33:43.839 going to stop updating. And so, you know, if 00:33:43.839 --> 00:33:45.640 you are in an environment that has lots of folks 00:33:45.640 --> 00:33:49.279 coming in or leaving, you may notice it more 00:33:49.279 --> 00:33:52.279 quickly than other environments. So go and check 00:33:52.279 --> 00:33:54.789 that one out. Do you know, Chris, why Microsoft 00:33:54.789 --> 00:33:57.470 decided to abandon this whole idea? Is it the 00:33:57.470 --> 00:34:00.049 security reason, perhaps? No, I think it's got 00:34:00.049 --> 00:34:02.509 to do with processing and stuff like that. I 00:34:02.509 --> 00:34:06.869 feel like there's a fair bit of intensity in 00:34:06.869 --> 00:34:09.809 processing these rules every single time. And 00:34:09.809 --> 00:34:11.650 so I guess it's probably just a scale thing. 00:34:12.250 --> 00:34:15.449 I'm not entirely sure. They've sort of indicated 00:34:15.449 --> 00:34:18.869 that they are working on... an alternative or 00:34:18.869 --> 00:34:22.829 a different way to do this. But there isn't anything 00:34:22.829 --> 00:34:25.630 that I've been able to find, you know, as a replacement 00:34:25.630 --> 00:34:28.030 feature or replacement functionality for this, 00:34:28.050 --> 00:34:29.650 right? So you really got to try and find different 00:34:29.650 --> 00:34:33.289 ways to try and construct the same group membership 00:34:33.289 --> 00:34:36.030 now. And, you know, again, I think attributes 00:34:36.030 --> 00:34:39.190 probably make the most sense. But for a long 00:34:39.190 --> 00:34:41.920 time, folks have been, you know, done done this 00:34:41.920 --> 00:34:44.800 transition from moving from on -prem to the cloud 00:34:44.800 --> 00:34:46.219 and they've done it sort of in a half -hearted 00:34:46.219 --> 00:34:48.579 way right where you haven't fully committed and 00:34:48.579 --> 00:34:51.320 so you're still using legacy groups perhaps that 00:34:51.320 --> 00:34:54.440 are on -prem as a way and and this is i think 00:34:54.440 --> 00:34:56.480 going to force people's hand now to start looking 00:34:56.480 --> 00:35:01.179 at like modernizing the way they provision their 00:35:01.179 --> 00:35:03.400 accounts and and the workflows that they have 00:35:03.400 --> 00:35:07.019 around it um so definitely something to look 00:35:07.019 --> 00:35:11.019 out for um because dynamic groups are they updated 00:35:11.019 --> 00:35:17.280 in a set interval or is it just depending on 00:35:17.280 --> 00:35:19.980 when microsoft cares about updating them in the 00:35:19.980 --> 00:35:22.880 back end no there is an interval for them um 00:35:22.880 --> 00:35:25.699 i that's a good question actually as to how often 00:35:25.699 --> 00:35:27.320 that interval happens i'm not sure i don't know 00:35:27.320 --> 00:35:29.800 i was doing but i can imagine if you have a lot 00:35:29.800 --> 00:35:32.199 of dynamic groups and they have thousands or 00:35:32.199 --> 00:35:34.280 hundreds of thousands of tenants worldwide i 00:35:34.280 --> 00:35:37.280 can imagine that it will quickly add up uh processing 00:35:37.280 --> 00:35:39.340 these right and it's probably one of the reasons 00:35:39.340 --> 00:35:41.960 why as well we don't have nested groups in intro 00:35:41.960 --> 00:35:47.199 right is because to to um basically do an audit 00:35:47.199 --> 00:35:50.199 or to go and have a look at every group member 00:35:50.199 --> 00:35:52.739 and then every nested group member within those 00:35:52.739 --> 00:35:55.019 groups like it that is pretty resource intensive 00:35:55.019 --> 00:35:58.929 um i actually was uh doing a um a conditional 00:35:58.929 --> 00:36:01.389 access audit for a customer a little while back 00:36:01.389 --> 00:36:06.670 and i was having to like flatten out um conditional 00:36:06.670 --> 00:36:08.769 access policies and how they apply to groups 00:36:08.769 --> 00:36:10.590 and then members of the do you know what i mean 00:36:10.590 --> 00:36:13.510 like go down the tree and it took forever to 00:36:13.510 --> 00:36:16.789 to to crunch that data right just because you've 00:36:16.789 --> 00:36:18.849 got as you start pulling on the string like it 00:36:18.849 --> 00:36:20.690 it becomes a really long piece of string and 00:36:20.690 --> 00:36:22.289 so i i imagine it's got something to do with 00:36:22.289 --> 00:36:26.989 that um uh and you know it's not ideal but it 00:36:26.989 --> 00:36:30.150 does possibly give everyone the opportunity now 00:36:30.150 --> 00:36:33.090 to spend some time to like make your groups more 00:36:33.090 --> 00:36:35.210 efficient anyway if you are using dynamic groups 00:36:35.210 --> 00:36:37.349 make them a little bit more efficient help with 00:36:37.349 --> 00:36:39.030 the processing on those and make them especially 00:36:39.030 --> 00:36:41.489 if you've got a very live environment so something 00:36:41.489 --> 00:36:44.170 to think about would you say that microsoft might 00:36:44.170 --> 00:36:47.880 be needing all the computer power elsewhere You 00:36:47.880 --> 00:36:51.900 know, this is this co -pilot thing, right? This 00:36:51.900 --> 00:36:54.760 AI thing that is burning resources, right? And 00:36:54.760 --> 00:36:57.260 burning down data centers. So it's possible that 00:36:57.260 --> 00:37:00.079 that's probably where it is. Let's see where 00:37:00.079 --> 00:37:03.739 we can save money, right? Well, you put a lot 00:37:03.739 --> 00:37:06.139 of links in the show notes as well about retirement. 00:37:06.519 --> 00:37:08.559 I really appreciate the PowerShell script you 00:37:08.559 --> 00:37:12.679 shared with everybody. Also, my topic has quite 00:37:12.679 --> 00:37:16.440 a long list of links. So, yeah, if this sounds 00:37:16.440 --> 00:37:19.760 interesting to you, make a visit to our website 00:37:19.760 --> 00:37:23.320 or open the show notes from your podcast player. 00:37:24.400 --> 00:37:26.920 Yeah, absolutely. I definitely would call out 00:37:26.920 --> 00:37:31.380 the lazy admin. His name is Ruud. I think he's 00:37:31.380 --> 00:37:36.000 a Dutch MVP living in Sweden, I think. I saw 00:37:36.000 --> 00:37:37.440 the name Ruud. I was like, he's got to be Dutch. 00:37:38.059 --> 00:37:41.800 And he has a really, really good article on this 00:37:41.800 --> 00:37:44.420 as well. I have listed that in the show notes. 00:37:45.710 --> 00:37:47.869 Just to kind of talk about ways to, you know, 00:37:47.869 --> 00:37:50.550 he expands a little bit on locating these things 00:37:50.550 --> 00:37:52.869 and has some options on, you know, good ways 00:37:52.869 --> 00:37:56.510 to try and address these. If you find groups, 00:37:56.590 --> 00:37:58.849 for example, that you need to restructure or 00:37:58.849 --> 00:38:01.289 reorganize, he's got good tips on that. Tony 00:38:01.289 --> 00:38:03.190 Redmond also did some commentary on that on, 00:38:03.210 --> 00:38:05.550 you know, Office 365 for IT Pros. There's some 00:38:05.550 --> 00:38:07.710 commentary there. So, yeah, definitely check 00:38:07.710 --> 00:38:10.989 out the show notes. Real quick, there's a couple 00:38:10.989 --> 00:38:12.789 more little things I sort of wanted to cover 00:38:12.789 --> 00:38:15.710 here just while we're talking about dynamic groups. 00:38:17.369 --> 00:38:20.670 Agents, ending up in your dynamic groups is another 00:38:20.670 --> 00:38:22.650 one to look out for for folks. This is obviously 00:38:22.650 --> 00:38:26.070 a relatively new problem. But if you think about 00:38:26.070 --> 00:38:29.170 agent identities, they're just types of user 00:38:29.170 --> 00:38:30.989 identities, right? It's kind of like a subtype 00:38:30.989 --> 00:38:33.989 of user identity. And so if your group structure 00:38:33.989 --> 00:38:38.010 isn't or your group filters are not set up correctly. 00:38:38.599 --> 00:38:40.940 to be looking for agents, what you may end up 00:38:40.940 --> 00:38:44.059 finding is that you have this wide sort of search 00:38:44.059 --> 00:38:47.280 query that includes agent identities in your 00:38:47.280 --> 00:38:51.280 dynamic groups and you don't intend to. Now, 00:38:51.400 --> 00:38:54.440 that could be a problem if you have, I don't 00:38:54.440 --> 00:38:57.099 know, if you're assigning security based on group 00:38:57.099 --> 00:38:58.960 membership and you don't want agents to be part 00:38:58.960 --> 00:39:01.440 of that, which, you know, why would you? Maybe 00:39:01.440 --> 00:39:04.000 you're assigning licenses based on these memberships 00:39:04.000 --> 00:39:07.159 and you're including all users, which will automatically 00:39:07.159 --> 00:39:11.599 include agent identities. So while you're going 00:39:11.599 --> 00:39:14.199 through your groups and you're looking to see 00:39:14.199 --> 00:39:17.539 how you can sort of optimize those groups, look 00:39:17.539 --> 00:39:20.539 out for this one as well. And there are some 00:39:20.539 --> 00:39:23.000 really interesting sort of ways to try and approach 00:39:23.000 --> 00:39:25.960 this. Meryl Fernando has actually done some really 00:39:25.960 --> 00:39:28.659 good work on this. And I've linked to an article 00:39:28.659 --> 00:39:36.710 on his blog about using attributes to tag your 00:39:36.710 --> 00:39:39.869 identities in a way that you know when it's a 00:39:39.869 --> 00:39:42.389 human identity versus an agent. And actually, 00:39:42.489 --> 00:39:47.909 it's not about tagging the agents. It's actually 00:39:47.909 --> 00:39:51.130 about tagging the user identities, the human 00:39:51.130 --> 00:39:53.789 identities. Because if you think about it, if 00:39:53.789 --> 00:39:58.909 you rely on a tag to exclude an agent from a 00:39:58.909 --> 00:40:01.690 dynamic group, and that agent for some reason 00:40:01.690 --> 00:40:03.510 gets provisioned and doesn't get the right tag 00:40:03.510 --> 00:40:06.210 or the right attribute, then it's going to fail, 00:40:06.329 --> 00:40:08.809 you know, in a way that they'll be included, 00:40:08.889 --> 00:40:13.489 right, by default. Whereas if you tag human identities 00:40:13.489 --> 00:40:17.130 the other way, you know, do the other way around, 00:40:17.210 --> 00:40:19.610 so tag human identities and only include them, 00:40:19.730 --> 00:40:22.250 the worst case scenario is, you know, a human 00:40:22.250 --> 00:40:28.360 identity gets either excluded or included. inadvertently, 00:40:28.380 --> 00:40:31.019 if there's a failure, it's not as bad of a problem. 00:40:31.260 --> 00:40:33.619 So Merrill writes all of this stuff up. He's 00:40:33.619 --> 00:40:35.679 got some really good attributes that he talks 00:40:35.679 --> 00:40:38.559 about that you can kind of look for. Have a look 00:40:38.559 --> 00:40:40.920 at his blog there. I've included that. I wanted 00:40:40.920 --> 00:40:44.320 to just bring this up to folks that there is 00:40:44.320 --> 00:40:46.619 this possibility, right, that if agents are all 00:40:46.619 --> 00:40:49.159 over our tenants now, even if you haven't yourself 00:40:49.159 --> 00:40:53.269 created them or added them. You still have agents 00:40:53.269 --> 00:40:56.989 in your M365 tenant, I guarantee you. And employees 00:40:56.989 --> 00:40:59.530 are creating them as well. That's right. And 00:40:59.530 --> 00:41:02.469 again, if you sit and forget your dynamic groups 00:41:02.469 --> 00:41:06.570 and you created a dynamic group with rules five 00:41:06.570 --> 00:41:08.510 years ago and you've never looked at them again, 00:41:08.710 --> 00:41:11.510 chances are you're going to have members in that 00:41:11.510 --> 00:41:13.630 group that you didn't intend. So have a look 00:41:13.630 --> 00:41:17.469 at that. The last piece about talking about dynamic 00:41:17.469 --> 00:41:19.829 groups is more of a security -related one. It's 00:41:19.829 --> 00:41:23.510 about the abuse of dynamic groups and how potentially 00:41:23.510 --> 00:41:29.449 folks can get themselves included in a group 00:41:29.449 --> 00:41:33.750 or how inadvertently users can get themselves 00:41:33.750 --> 00:41:35.650 included in a group just by changing attributes. 00:41:35.989 --> 00:41:39.269 So a dynamic group is only as secure as the attributes 00:41:39.269 --> 00:41:45.239 that you use. So a really good sort of strategy 00:41:45.239 --> 00:41:49.619 here is to understand who can change the attributes 00:41:49.619 --> 00:41:52.900 that you're using for your dynamic group rules, 00:41:53.079 --> 00:41:56.000 right? So for example, if you have a dynamic 00:41:56.000 --> 00:41:59.730 group and you're allowing... you know, the office 00:41:59.730 --> 00:42:04.050 field and it, you know, it creates a group based 00:42:04.050 --> 00:42:06.769 on users in a particular office field. Well, 00:42:06.869 --> 00:42:09.550 if the users can change or update their own office 00:42:09.550 --> 00:42:12.210 location, then you're giving them the ability 00:42:12.210 --> 00:42:14.849 to manipulate the group that they belong in. 00:42:14.929 --> 00:42:17.670 Now, if it's only a distribution list or something 00:42:17.670 --> 00:42:20.030 like that, it doesn't matter. But if it's a security 00:42:20.030 --> 00:42:22.309 group and you want to secure something for specific 00:42:22.309 --> 00:42:25.360 users in a specific office, well, you know. you 00:42:25.360 --> 00:42:29.159 may find yourself not being as locked down or 00:42:29.159 --> 00:42:31.659 secure as you really want to. And this becomes 00:42:31.659 --> 00:42:34.400 really interesting when you have guest accounts 00:42:34.400 --> 00:42:38.960 and guest things like that. So there is a really 00:42:38.960 --> 00:42:42.920 interesting topic or article I found from Tenable 00:42:42.920 --> 00:42:47.809 about... sort of exploitation of group attributes 00:42:47.809 --> 00:42:50.969 and things like that. So I wanted to raise this 00:42:50.969 --> 00:42:53.190 one up for folks as well. Like, again, if you're 00:42:53.190 --> 00:42:54.769 going to spend the time looking at your groups 00:42:54.769 --> 00:42:57.929 and doing a little bit of housekeeping on your 00:42:57.929 --> 00:43:01.369 groups, make sure firstly that you're not including 00:43:01.369 --> 00:43:04.230 agents where you don't want agents. And secondly, 00:43:04.269 --> 00:43:07.590 make sure that the attributes you're using to 00:43:07.590 --> 00:43:11.159 build the groups. can't be easily manipulated 00:43:11.159 --> 00:43:14.260 or um if you don't want them to be easily manipulated 00:43:14.260 --> 00:43:16.780 you have a way to to kind of lock them down right 00:43:16.780 --> 00:43:20.219 so um you know build rules and access control 00:43:20.219 --> 00:43:22.699 especially for access control groups on uh with 00:43:22.699 --> 00:43:25.579 attributes that are locked down in a way right 00:43:25.579 --> 00:43:27.619 only admins can change those attributes or or 00:43:27.619 --> 00:43:30.320 maybe your hr system but not no one else right 00:43:31.230 --> 00:43:34.429 exclude user users um very explicitly that's 00:43:34.429 --> 00:43:36.829 a that's a really really good one as well um 00:43:36.829 --> 00:43:40.909 and um you know we talk about um restricting 00:43:40.909 --> 00:43:43.969 guest invitations uh to to any specific admin 00:43:43.969 --> 00:43:45.730 roles and things like that as well because this 00:43:45.730 --> 00:43:48.070 really does affect guest accounts as well um 00:43:48.070 --> 00:43:50.309 and that's actually a cis benchmark as well so 00:43:50.309 --> 00:43:52.500 making sure that you know being able to send 00:43:52.500 --> 00:43:55.940 a guest invites to for folks to collaborate with 00:43:55.940 --> 00:43:58.000 your organization is, is, is limited and locked 00:43:58.000 --> 00:44:00.980 down. So have a look at these things and hopefully 00:44:00.980 --> 00:44:03.159 these tips will kind of help you do a little 00:44:03.159 --> 00:44:05.179 bit of housekeeping on your, on your dynamic 00:44:05.179 --> 00:44:07.880 groups. Definitely. It's definitely time for 00:44:07.880 --> 00:44:09.880 us to have a look at them. I think they've probably 00:44:09.880 --> 00:44:11.579 been working in the background for, for years, 00:44:11.739 --> 00:44:14.639 but there's a lot of stuff going on in, you know, 00:44:14.639 --> 00:44:18.219 in the tenant now. So time to time to have a 00:44:18.219 --> 00:44:20.969 look at them. Yeah. Well, thanks, Chris, for 00:44:20.969 --> 00:44:24.769 bringing this practical advice from the field 00:44:24.769 --> 00:44:27.309 to the episode. I think it's definitely an important 00:44:27.309 --> 00:44:30.050 subject. Absolutely. And it's a small thing, 00:44:30.150 --> 00:44:32.030 but, you know, it can make a big difference if 00:44:32.030 --> 00:44:37.030 not done properly. Yeah, I agree. So before we 00:44:37.030 --> 00:44:40.269 move on to a community project, I'd like to do 00:44:40.269 --> 00:44:42.929 a very short plug, and I will probably repeat 00:44:42.929 --> 00:44:45.929 it in next month's episode as well. Yellow Hat 00:44:45.929 --> 00:44:49.030 is already in full steam ahead. We're working 00:44:49.030 --> 00:44:52.789 very hard behind the curtains to make this Microsoft 00:44:52.789 --> 00:44:55.949 Cybersecurity Conference a fact again in January. 00:44:56.630 --> 00:44:59.309 But I want to remind everybody that if you cannot 00:44:59.309 --> 00:45:03.449 come to Amsterdam region yourself on January 00:45:03.449 --> 00:45:08.079 19th, free streaming tickets so go to yellowhat 00:45:08.079 --> 00:45:12.119 .live and buy quote -unquote yourself a free 00:45:12.119 --> 00:45:14.360 streaming ticket if you want don't want to miss 00:45:14.360 --> 00:45:18.300 the live stream on january 19 we have some great 00:45:18.300 --> 00:45:20.840 speakers already lining up the the schedule is 00:45:20.840 --> 00:45:26.070 not 100 formalized if you're going If you're 00:45:26.070 --> 00:45:28.289 in the Netherlands or around the Netherlands 00:45:28.289 --> 00:45:31.409 and want to come, I really would advise you to 00:45:31.409 --> 00:45:34.650 move quick on attending in person. And then you 00:45:34.650 --> 00:45:36.829 will be able to grab one of these electronic 00:45:36.829 --> 00:45:39.210 badges as well. So we have an electronic badge 00:45:39.210 --> 00:45:41.610 this year for Yellow Hat. We want to imitate 00:45:41.610 --> 00:45:44.409 DEF CON a little bit. But it's only for the first 00:45:44.409 --> 00:45:49.250 150 people on site. So, yeah. Sorry for that, 00:45:49.250 --> 00:45:51.230 Chris. A little bit of a shameless plug. No, 00:45:51.230 --> 00:45:55.239 that's absolutely awesome. Hey, we've been sort 00:45:55.239 --> 00:45:57.980 of trying to support Yellow Hat for the last 00:45:57.980 --> 00:46:00.380 couple of years. I guess we're an unofficial 00:46:00.380 --> 00:46:04.260 Yellow Hat podcast, supporting podcast. But no, 00:46:04.320 --> 00:46:06.199 look, I know how much effort you guys put into 00:46:06.199 --> 00:46:10.119 putting on this. And folks, really, I mean, Coast 00:46:10.119 --> 00:46:11.639 has been working on this stuff for the last couple 00:46:11.639 --> 00:46:13.800 of months already. So if you think about six 00:46:13.800 --> 00:46:16.519 months, you know, six months before the event, 00:46:16.619 --> 00:46:18.539 these guys are already sort of full steam ahead, 00:46:18.719 --> 00:46:21.139 guys and gals, full steam ahead planning this. 00:46:22.320 --> 00:46:24.119 some support and have a look and i guarantee 00:46:24.119 --> 00:46:26.639 you it's worth the effort uh the the speakers 00:46:26.639 --> 00:46:29.179 and and if you can attend it and i unfortunately 00:46:29.179 --> 00:46:31.739 january is just not a good time for me to be 00:46:31.739 --> 00:46:33.960 in amsterdam otherwise i would do everything 00:46:33.960 --> 00:46:36.739 i can to be there but if you can get there uh 00:46:36.739 --> 00:46:39.579 you you really should And unfortunately for you 00:46:39.579 --> 00:46:43.340 as well, Chris, we shifted our schedule. So we 00:46:43.340 --> 00:46:46.500 start at three. No, we open doors at one, but 00:46:46.500 --> 00:46:49.300 the session started three or four -ish. I don't 00:46:49.300 --> 00:46:51.840 know from the top of my head. The keynote is 00:46:51.840 --> 00:46:54.739 at three. Yeah, 3 p .m. European time. And we 00:46:54.739 --> 00:46:58.760 deliberately did that so that the American viewers 00:46:58.760 --> 00:47:03.099 could also join. But unfortunately, this makes 00:47:03.099 --> 00:47:06.280 it so that people in Australia would have a hard 00:47:06.280 --> 00:47:09.920 time attending. the live stream right yeah that 00:47:09.920 --> 00:47:11.380 would probably wouldn't be the best time for 00:47:11.380 --> 00:47:14.159 us but hey you know down under here we're used 00:47:14.159 --> 00:47:16.760 to that type of thing so it's it's it's a it's 00:47:16.760 --> 00:47:20.539 a problem Yeah, well, we are not recording it 00:47:20.539 --> 00:47:24.800 for a lot of reasons. So you have to attend the 00:47:24.800 --> 00:47:29.019 live stream if you want to watch our eight amazing 00:47:29.019 --> 00:47:32.699 sessions we have lined up. Otherwise, you'll 00:47:32.699 --> 00:47:36.320 miss it and we'll not be able to watch it back 00:47:36.320 --> 00:47:39.480 in a later stage. Fair enough. So, folks, I think 00:47:39.480 --> 00:47:42.280 check that out. Yellowhat .live, right, Koos, 00:47:42.280 --> 00:47:46.219 is the link? Fair enough. Very cool. Yeah, so 00:47:46.219 --> 00:47:49.699 to close out with our community project for this 00:47:49.699 --> 00:47:52.360 month, honestly, I was shocked that we hadn't 00:47:52.360 --> 00:47:55.380 already talked about this. I don't know why, 00:47:55.480 --> 00:47:56.719 but when I was putting together the notes for 00:47:56.719 --> 00:48:00.400 this, I was like, I can't believe we haven't 00:48:00.400 --> 00:48:04.030 talked about it. So DC Toolbox is... It's a tool 00:48:04.030 --> 00:48:07.050 that I myself have used quite a lot in the past, 00:48:07.250 --> 00:48:10.269 especially when I'm doing sort of audits for 00:48:10.269 --> 00:48:13.869 customers around conditional access and conditional 00:48:13.869 --> 00:48:15.590 access policies. And it actually does a lot more 00:48:15.590 --> 00:48:19.409 than that, but it's a PowerShell module built 00:48:19.409 --> 00:48:24.920 by an MVP, Daniel Crowland. And he's a Swedish 00:48:24.920 --> 00:48:29.219 MVP. He's built this DC Toolbox. I think it's 00:48:29.219 --> 00:48:31.420 in version 2 .something already. So it's a very 00:48:31.420 --> 00:48:36.039 well -established, mature module. And it does 00:48:36.039 --> 00:48:40.539 a heap of things, right? Like I said, I have 00:48:40.539 --> 00:48:42.719 mostly ever used it for conditional access stuff. 00:48:43.099 --> 00:48:45.679 And really what it allows you to do is it actually 00:48:45.679 --> 00:48:49.480 allows you to establish a conditional access 00:48:49.480 --> 00:48:53.510 baseline. export that and re -import it into 00:48:53.510 --> 00:48:55.690 other tenants. And so if you think about MSP 00:48:55.690 --> 00:49:00.449 scenarios where maybe you're deploying a baseline 00:49:00.449 --> 00:49:02.989 config for all of your customers, things like 00:49:02.989 --> 00:49:05.769 that, this tool is gold for that type of thing. 00:49:06.570 --> 00:49:08.849 Daniel's actually created his own baselines as 00:49:08.849 --> 00:49:11.050 well. And it's very funny because he's got a 00:49:11.050 --> 00:49:13.989 very specific naming convention and I... I often 00:49:13.989 --> 00:49:17.050 see his baselines used in customer environments 00:49:17.050 --> 00:49:19.829 when I look at the conditional access policy. 00:49:20.070 --> 00:49:22.489 So really, really cool tool. It does some intro 00:49:22.489 --> 00:49:25.210 hygiene stuff as well. He's actually got some 00:49:25.210 --> 00:49:29.849 really interesting sort of proof of concept red 00:49:29.849 --> 00:49:32.889 teaming tools built into it as well. I've not 00:49:32.889 --> 00:49:35.760 really played with too much of it. But it does 00:49:35.760 --> 00:49:38.119 look really, really interesting if you have a 00:49:38.119 --> 00:49:40.559 testing environment that you can kind of let 00:49:40.559 --> 00:49:44.280 loose in. My environments that I work in, especially 00:49:44.280 --> 00:49:47.519 the ones lately, are very restricted. So this 00:49:47.519 --> 00:49:50.139 would not be a good idea for those. But I actually 00:49:50.139 --> 00:49:53.159 have recently came across a customer who's actually 00:49:53.159 --> 00:49:57.320 using DC Toolbox for a lot of their sort of SecOps 00:49:57.320 --> 00:50:01.110 automation. processes are built around this module. 00:50:01.550 --> 00:50:04.090 It is a very, very useful module, especially 00:50:04.090 --> 00:50:05.670 if you're doing anything, like I said, entra, 00:50:05.809 --> 00:50:08.090 conditional access, things like that. So lots 00:50:08.090 --> 00:50:10.570 of effort's been put into it. Daniel, shout out, 00:50:10.590 --> 00:50:13.730 fantastic tool. The links in the show notes to 00:50:13.730 --> 00:50:16.769 both his website and to the GitHub repository 00:50:16.769 --> 00:50:19.909 for this one. I would strongly encourage you 00:50:19.909 --> 00:50:22.210 to go check this out. It's something I use often. 00:50:22.369 --> 00:50:26.989 It's a really cool thing. Nice find. Thanks for 00:50:26.989 --> 00:50:29.739 sharing. Yeah, no problem. No problem at all. 00:50:29.800 --> 00:50:31.460 Like I said, shocked that we hadn't talked about 00:50:31.460 --> 00:50:34.699 it before, but here it is now. So hopefully everyone 00:50:34.699 --> 00:50:37.639 finds this really useful. Yeah, well, still we 00:50:37.639 --> 00:50:41.019 were able to share a community project every 00:50:41.019 --> 00:50:46.880 episode. We made how many now? 21 episodes until 00:50:46.880 --> 00:50:48.739 now, something like that? Something like that, 00:50:48.840 --> 00:50:52.599 yeah. It's good to put some spotlight on some 00:50:52.599 --> 00:50:55.800 other fellow MVPs or members from the community. 00:50:56.349 --> 00:50:58.269 Yeah, that's right. There's so many folks doing 00:50:58.269 --> 00:51:02.250 such good stuff that it really is. It's a, it's 00:51:02.250 --> 00:51:03.949 good to have them. And it, you know, it actually 00:51:03.949 --> 00:51:06.630 helps me because I, I often talk to someone and 00:51:06.630 --> 00:51:08.250 they're like, Hey, I need to do this thing. I'm 00:51:08.250 --> 00:51:10.969 like, Hey, there's a tool for that. And the link 00:51:10.969 --> 00:51:13.969 is on our, on our, on our podcast blog. So go 00:51:13.969 --> 00:51:16.929 and find it there. There's an app for that. Yeah. 00:51:17.989 --> 00:51:23.699 Yeah. Nice. Yep. Yeah, this brings us to the 00:51:23.699 --> 00:51:26.360 end of today's episode. I think we had a long 00:51:26.360 --> 00:51:28.599 episode, almost an hour when I look at the counter. 00:51:28.760 --> 00:51:31.659 I hope people enjoyed listening for such a long 00:51:31.659 --> 00:51:37.300 while. Again, I will be enjoying some time off 00:51:37.300 --> 00:51:41.719 in the south of Spain. And we'll see everybody 00:51:41.719 --> 00:51:45.480 and hear everybody next month again. And I'd 00:51:45.480 --> 00:51:48.480 like to thank everybody for listening. If you 00:51:48.480 --> 00:51:50.679 have any questions, reach out to us on LinkedIn. 00:51:51.530 --> 00:51:54.170 drop a comment on Spotify or wherever you're 00:51:54.170 --> 00:51:58.030 listening and we'll try and incorporate it into 00:51:58.030 --> 00:52:00.610 the episodes. And yeah, I think that's it for 00:52:00.610 --> 00:52:02.489 today. Thanks for listening. Yeah, thank you. 00:52:02.530 --> 00:52:04.989 Until next time, take care. Bye -bye. Bye.