OPERATIONAL /30 field notes Search ⌘K

Blue Team of One

Real defensive work.
Written honestly.

The mechanism, the gotcha, the reusable lesson — from real engagements, never a client story.

DETECTION · SERIES

Sentinel, from the loading dock to the lake

The platform from the ground up — data foundation, detection, and response.

PART 01 · 02 · 03 — read in order ›

POWERSHELL LIBRARY

PS BlueTeam:\> Get-FieldNote
# reusable tooling,
# ready to run

Get-MailboxHolds
Get-PrivilegedAccess

Open the library › INCIDENT RESPONSE

The iPhone she never owned

Read › SINCE 2025

field notes · 9 verticals

Killing standing admin with tiered PIM

Kill permanent Global Admin without breaking the ops that depend on it.

Read › DETECTION

What the logs won’t tell you

Read › SEARCH

Get-FieldNote -Match …

⌘ K from anywhere

Recent field notes

DETECTIONHow Sentinel responds: the reflex and the muscleSep 1 DETECTIONHow Sentinel detects: rules, alerts, incidents, and the huntSep 1 FORENSICSThe OneDrive that comes back — then leaves againAug 31 IDENTITYTemporary Access Pass is a loaded gunAug 28 IRThe iPhone she never ownedAug 28

Browse by topic

Identity Security 9 Detection Engineering 6 Endpoint Security 4 Digital Forensics 3 Email Security 3 Incident Response 2 Cloud Security 2 SOC Operations 1 PowerShell Library 2