Um pouco sobre como o processo funciona

Vou começar com um pouco de contexto em como a alocação de CPU funciona no Kernel do Linux. Vamos olhar para o núcleo de um processador, ele é capaz de processar uma única operação por vez, não tem mágica, você manda a operação ele processa e retorna. Se você tem dois cores, duas operações por vez e assim por diante.

Mesmo os processadores com Hyper Threading o núcleo do processador continua processando task a task, uma por vez, a tecnologia Hyper Threading (presente em processadores intel) mantém o core mais tempo processando do que ocioso, ou seja, usa melhor o tempo, mas nada mudou no núcleo, continuamos não podendo paralelizar as tarefas, apenas melhorar a concorrência entre elas.

Kernel do Linux gerenciando tarefas

Falamos um pouco da camada de hardware, agora vamos para a camada de software. Para simplificar, vamos imaginar um processador com apenas 1 core (um Intel 4004). Se você simplificar as coisas e pensar que 1 core pode processar 1 task por vez, e você tiver uma task que vai levar 10min para terminar, significa que seu processador vai ficar processando apenas esta task por 10min, o que obviamente travaria todo seu Sistema Operacional. Imagina, enquanto você está baixando um arquivo você não iria conseguir mexer o mouse, digitar no teclado, ou escutar uma música.

É para isso que existem o que chamamos de CPU Schedulers. São programas que rodam no S.O que fazem o gerenciamento das tasks que irão rodar no núcleo do processador, e obviamente eles não vão permitir que sua task de 10min cause um starvation nos outros processos. E como isso funciona ? Bom, existem diversos tipos de Schedulers, dependendo do seu S.O, vamos focar aqui no Linux. A partir da versão 2.6.23 do Kernel do Linux é utilizado um Scheduler chamado Completely Fair Scheduler (a.k.a CFS).

O CFS, como o nome já diz, tenta garantir a distribuição justa (fair) da CPU entre os processos do S.O. Em termos simples, isso significa que se você tem 1 core e 2 processos (P1 e P2), P1 vai usar 50% da CPU e P2 vai usar 50% da CPU, em termos simples ok ? É bem mais complexo que isso, envolve prioridade e agrupamento de processos, mas em termos gerais o CFS tenta distribuir igualmente.

Limits no Kubernetes

Agora que você entende como as tasks são distribuídas no núcleo do processador, vamos falar de Kubernetes. Mas primeiro, tenha em mente uma importante lição tirada da explicação acima, o ideal é que o processador fique ocupado 100% do tempo, usando 100% do seu núcleo para processar o máximo de tarefas, sem ociosidade.

Para o Kubernetes existem 2 tipos de recursos: compressible resources e not compressible resources , traduzindo para o Português, recursos compreensíveis e não compreensíveis. A memória, por exemplo, é um recurso não compreensível porque ao atingir o máximo permitido o K8s vai enviar um sinal de SIGKILL para o seu POD, por outro lado a CPU é um recurso compreensível, ou seja, mesmo que você esteja com 100% de uso, o K8s não vai mandar um SIGKILL. Porque isso ? A memória tem um tamanho finito, e quando você a enche não tem mais para onde ir, o que fazer ? Matar qualquer processo que tente usar mais memória do que o disponível. Já a CPU, tenta alocar todos os processos, porque ela trabalha com tempo, que não é um recurso finito, você pode alocar milhares de processos dentro de milli/micro/nano segundos. É óbvio se você tiver milhares de processos e apenas 1 core, cada processo vai usar 0,001% da cpu, deixando o seu S.O muito lento, devido a grande quantidade de troca entre os processos no núcleo do processador.

Agora podemos responder porque não usar Limit CPU no K8s. Quando você configura um limite de CPU, vamos supor 200m (200 millicores), você está dizendo para o K8s: “não deixe meu processo usar mais de 200 milissegundos da CPU a cada ciclo de 1 segundo“. Então vamos supor que por alguns instantes a CPU esteja livre de outros processos, você poderia estar usando 100% dela, mas estará limitado a 20% (200m), com 80% da cpu ociosa. Agora imagina que você tire esse limite, o Linux CFS vai tentar distribuir igualmente a carga da CPU entre seus PODs, e cá entre nós, provavelmente ele fará um trabalho melhor que eu e você tentando configurar um limite de CPU.

Agora um aviso muito !!IMPORTANTE!!, eu não estou dizendo que você deve sair tirando o limit CPU de todos os seus projetos. Se você tem PODs que não precisam de alto throughput , você deve sim limitar o uso de CPU, para que não haja uma concorrência pelo uso da CPU com outros PODs que realmente precisam de alto throughput. Lembra que o Linux CFS vai tentar distribuir igualmente o uso da CPU, e PODs que precisam de alta vazão podem ser impactados por aqueles que não precisam, simplesmente porque o CFS vai tentar ser fair .

Para quem chegou até aqui meu muito obrigado. Críticas e sugestões ? Deixa seu comentário.

​Microsoft Tech Community – Latest Blogs –Read More 

I’m excited to announce a new function, TRIMRANGE, and a set of new reference operators.

NOTE: This is a preview function. Its signature and results may change substantially before being broadly released, based on your feedback. So, we do not recommend using it in important workbooks until it is generally available. 

New TRIMRANGE function and trim refs: easily remove blanks from the edges of a range

We’re introducing a new function and a set of supporting references:

TRIMRANGE function – a function that removes empty rows from the edges of a range. 
Trim references – offer a more succinct way to call common variances of the TRIMRANGE function.

TRIMRANGE function

The TRIMRANGE function removes empty rows from the edges of a range. This can be particularly useful when writing dynamic array formulas or optimizing lambda functions for performance.

In the example below, we use TRIMRANGE to calculate the length of any text entered into column A.

Calculate the length of text entered into column A with TRIMRANGE

Without the use of TRIMRANGE, =LEN(A:A) would run on every cell, returning over a million unnecessary results. Besides being inefficient, trailing undesirable 0’s are returned to the grid. This can be especially problematic if you then try and operate on the spill using =C1# notation.

TRIMRANGE is also a great new tool for optimizing the performance of lambda functions that operate on ranges. It allows lambda authors to more tightly scope ranges, which can reduce the number of necessary computations. 

More information on the TRIMRANGE function can be found on the help page. 

Trim References

Trim References (‘Trim Refs’) offer a more succinct way to call common variances of TRIMRANGE. They are a modifier of the iconic colon range operator A1:E5. By prefixing or suffixing the colon with a period, you can request to trim blanks from the start, end or both.

Type

Example

Equivalent TRIMRANGE

Description

Trailing trim ref (:.)

A1:.E10

TRIMRANGE(A1:E10,2,2)

Trim trailing blanks

Leading trim ref (.:)

A1.:E10

TRIMRANGE(A1:E10,1,1) 

Trim leading blanks

Full trim ref (.:.)

A1.:.E10

TRIMRANGE(A1:E10,3,3)

Trim leading and trailing blanks

Full-column references are often avoided because they can have poor performance with some functions. However, with trim refs, they are much more performant as the full-column reference can be constrained to just the portion with values.

In the example below, we use the trailing trim ref to trim a full column reference. We expect trailing trim refs to be the most commonly used of the 3 trim ref variants. 

Trim a full column reference with trailing trim ref

Learn More

You can learn more about the TRIMRANGE function on our help page.

Availability

This new function and new references are currently available to Beta Channel users running Version 2409 (Build 18020.2000) or later.

Don’t have it yet? It’s probably us, not you.

Features are released over some time to ensure things are working smoothly. We highlight features that you may not have because they’re slowly releasing to larger numbers of Insiders. Sometimes we remove elements to further improve them based on your feedback. Though this is rare, we also reserve the option to pull a feature entirely out of the product, even if you, as an Insider, have had the opportunity to try it. 

Feedback

We want to hear from you! Please click Help > Feedback in Excel on Windows to submit your thoughts about these new functions.

Learn about the Microsoft 365 Insider program and sign up for the Microsoft 365 Insider newsletter to get the latest information about Insider features in your inbox once a month!

​Microsoft Tech Community – Latest Blogs –Read More 

Azure Durable Function-How to separate Orchestrator and Activity across different blueprints:

Durable Functions Overview – Azure | Microsoft Learn

​Microsoft Tech Community – Latest Blogs –Read More 

Hi,

as we perform actions on M365 customers tenant day to day, after changes we review what we did. After manage a mailbox and then set a ‘mail flow redirecion’, the redirection works fine but you cannot see the mailbox named for it, but only its ‘ID’.

> > > If you – reading this post -are a MS employee, pls, make sure to that issue goes to the right team to fix asap.

​Hi, as we perform actions on M365 customers tenant day to day, after changes we review what we did. After manage a mailbox and then set a ‘mail flow redirecion’, the redirection works fine but you cannot see the mailbox named for it, but only its ‘ID’.> > > If you – reading this post -are a MS employee, pls, make sure to that issue goes to the right team to fix asap.   Read More

​

Hello there,  so the situation we have is we want to lock down accessing any of our o365 apps from only approved devices.  I assume the only/best way to do this is via Intune.  What we want to do is have it setup where users can enroll devices or do auto enrollment as long as we can approve devices coming in.  We had a breach where someone was able to login to a users account that had MFA enabled still so the thought here is we would only allow access on devices we have approved.  Microsoft KB articles on enrollment seem a little dry on examples and instructions.  Does anyone have any good info on how to set something like that up if possible?   

​Hello there,  so the situation we have is we want to lock down accessing any of our o365 apps from only approved devices.  I assume the only/best way to do this is via Intune.  What we want to do is have it setup where users can enroll devices or do auto enrollment as long as we can approve devices coming in.  We had a breach where someone was able to login to a users account that had MFA enabled still so the thought here is we would only allow access on devices we have approved.  Microsoft KB articles on enrollment seem a little dry on examples and instructions.  Does anyone have any good info on how to set something like that up if possible?     Read More

​

I am currently facing an issue with rendering a contentURL in the modal view within the multistage view of my bot. I have implemented the following Adaptive Card, but the contentURL is not being rendered as expected. Instead, I’m getting the error message: “There was a problem reaching this app.” The same URL works correctly in a browser window.

Here is the sample Adaptive Card:

{
“type”: “Image”,
“url”: “ImageURL”,
“altText”: “Insights”,
“selectAction”: {
“type”: “Action.Submit”,
“title”: “Open”,
“data”: {
“msteams”: {
“type”: “invoke”,
“value”: {
“type”: “tab/tabInfoAction”,
“tabInfo”: {
“contentUrl”: “https://apiserver.ngrok.app/test”,
“websiteUrl”: “https://apiserver.ngrok.app/test”,
“name”: “utterance”,
“entityId”: “entityId”,
“openMode”: “modal”
}
}
}
}
}
}

​I am currently facing an issue with rendering a contentURL in the modal view within the multistage view of my bot. I have implemented the following Adaptive Card, but the contentURL is not being rendered as expected. Instead, I’m getting the error message: “There was a problem reaching this app.” The same URL works correctly in a browser window. Here is the sample Adaptive Card:    {
“type”: “Image”,
“url”: “ImageURL”,
“altText”: “Insights”,
“selectAction”: {
“type”: “Action.Submit”,
“title”: “Open”,
“data”: {
“msteams”: {
“type”: “invoke”,
“value”: {
“type”: “tab/tabInfoAction”,
“tabInfo”: {
“contentUrl”: “https://apiserver.ngrok.app/test”,
“websiteUrl”: “https://apiserver.ngrok.app/test”,
“name”: “utterance”,
“entityId”: “entityId”,
“openMode”: “modal”
}
}
}
}
}
}           Read More

​

Hi everyone, I am trying to execute a macro for formatting some data I have as well as creating a workbook. If I am being honest, I do not have much experience with macros and used chatgpt as a reference. Chatgpt gave me the below code, which did work at first, but now I am having the error I mentioned above. The purpose of this macro is to do some formatting first, then rename that sheet to whatever today’s date is “mmddyy.” Then it should add a new sheet and name it “Data Pivot” which should then be moved to the beginning so it is first. At cell A1 there should be a pivot table which references the data in my previous sheet. My data is located at row 3 from cells A to I. I need my pivot table to select all filled cells from A3 down and up until column I. The issue I am having is that my macro is giving me an error once it is about to insert the pivot table at cell A1.

When I click debug this is where the error is:

Set pivotTbl = pivotWs.PivotTables.Add(PivotCache:=ThisWorkbook.PivotCaches.Create( _
SourceType:=xlDatabase, SourceData:=dataRange), TableDestination:=pivotWs.Cells(1, 1))

Please help!

This is my code:

Sub CreateReport()
Dim ws As Worksheet
Dim pivotWs As Worksheet
Dim pivotTbl As PivotTable
Dim dataRange As Range
Dim todaysDate As String

‘ Step 1: Delete column J
Columns(“J:J”).Delete

‘ Step 2: Add 2 new rows to the top
Rows(“1:2”).Insert Shift:=xlDown

‘ Step 3: Type “PB Charge Review by WQ” in cell A1
Range(“A1”).Value = “PB Charge Review by WQ”

‘ Step 4: Merge cells A1 and B1
Range(“A1:B1”).Merge

‘ Step 5: Bold cell A1 and make the font 12 pt
With Range(“A1”)
.Font.Bold = True
.Font.Size = 12
End With

‘ Step 6: Align the text in cell A1 to the left
Range(“A1”).HorizontalAlignment = xlLeft

‘ Step 7: Underline cells A3:I3 (headers)
Range(“A3:I3”).Font.Underline = xlUnderlineStyleSingle

‘ Step 8: Autofit columns A-I
Columns(“A:I”).AutoFit

‘ Step 9: Rename the sheet to today’s date (mmddyy)
todaysDate = Format(Date, “mmddyy”)
ActiveSheet.Name = todaysDate

‘ Step 10: Add a new sheet and move it to the beginning
Set pivotWs = Sheets.Add(Before:=Sheets(1))

‘ Step 11: Rename this new sheet to “Data Pivot”
pivotWs.Name = “Data Pivot”

‘ Step 12: Set the data range for the pivot table
Set ws = Sheets(todaysDate)
Set dataRange = ws.Range(“A3:I” & ws.Cells(ws.Rows.Count, “A”).End(xlUp).Row)

‘ Step 13: Create the pivot table in the new sheet
Set pivotTbl = pivotWs.PivotTables.Add(PivotCache:=ThisWorkbook.PivotCaches.Create( _
SourceType:=xlDatabase, SourceData:=dataRange), TableDestination:=pivotWs.Cells(1, 1))

‘ Step 14-19: Add fields to the pivot table and format them
With pivotTbl
‘ Add “Owning Area” to rows
.PivotFields(“Owning Area”).Orientation = xlRowField

‘ Add “Num of Chg Sess” to values as a sum
With .PivotFields(“Num of Chg Sess”)
.Orientation = xlDataField
.Function = xlSum
End With

‘ Add “Amt on Chg Rvw” to values as a sum
With .PivotFields(“Amt on Chg Rvw”)
.Orientation = xlDataField
.Function = xlSum
End With

‘ Add “Avg Svc Dt Age” to values as an average
With .PivotFields(“Avg Svc Dt Age”)
.Orientation = xlDataField
.Function = xlAverage
End With

‘ Add “Avg Age” to values as an average
With .PivotFields(“Avg Age”)
.Orientation = xlDataField
.Function = xlAverage
End With
End With

‘ Step 20: Format columns B, D, and E with custom number format to show dashes instead of zeros
pivotWs.Columns(2).NumberFormat = “#,##0;-#,##0;–”
pivotWs.Columns(4).NumberFormat = “#,##0;-#,##0;–”
pivotWs.Columns(5).NumberFormat = “#,##0;-#,##0;–”

‘ Step 21: Format column C as currency with no decimals
pivotWs.Columns(3).NumberFormat = “$#,##0”

End Sub

​Hi everyone, I am trying to execute a macro for formatting some data I have as well as creating a workbook. If I am being honest, I do not have much experience with macros and used chatgpt as a reference. Chatgpt gave me the below code, which did work at first, but now I am having the error I mentioned above. The purpose of this macro is to do some formatting first, then rename that sheet to whatever today’s date is “mmddyy.” Then it should add a new sheet and name it “Data Pivot” which should then be moved to the beginning so it is first. At cell A1 there should be a pivot table which references the data in my previous sheet. My data is located at row 3 from cells A to I. I need my pivot table to select all filled cells from A3 down and up until column I. The issue I am having is that my macro is giving me an error once it is about to insert the pivot table at cell A1. When I click debug this is where the error is: Set pivotTbl = pivotWs.PivotTables.Add(PivotCache:=ThisWorkbook.PivotCaches.Create( _
SourceType:=xlDatabase, SourceData:=dataRange), TableDestination:=pivotWs.Cells(1, 1))  Please help! This is my code: Sub CreateReport()
Dim ws As Worksheet
Dim pivotWs As Worksheet
Dim pivotTbl As PivotTable
Dim dataRange As Range
Dim todaysDate As String

‘ Step 1: Delete column J
Columns(“J:J”).Delete

‘ Step 2: Add 2 new rows to the top
Rows(“1:2”).Insert Shift:=xlDown

‘ Step 3: Type “PB Charge Review by WQ” in cell A1
Range(“A1”).Value = “PB Charge Review by WQ”

‘ Step 4: Merge cells A1 and B1
Range(“A1:B1”).Merge

‘ Step 5: Bold cell A1 and make the font 12 pt
With Range(“A1”)
.Font.Bold = True
.Font.Size = 12
End With

‘ Step 6: Align the text in cell A1 to the left
Range(“A1”).HorizontalAlignment = xlLeft

‘ Step 7: Underline cells A3:I3 (headers)
Range(“A3:I3”).Font.Underline = xlUnderlineStyleSingle

‘ Step 8: Autofit columns A-I
Columns(“A:I”).AutoFit

‘ Step 9: Rename the sheet to today’s date (mmddyy)
todaysDate = Format(Date, “mmddyy”)
ActiveSheet.Name = todaysDate

‘ Step 10: Add a new sheet and move it to the beginning
Set pivotWs = Sheets.Add(Before:=Sheets(1))

‘ Step 11: Rename this new sheet to “Data Pivot”
pivotWs.Name = “Data Pivot”

‘ Step 12: Set the data range for the pivot table
Set ws = Sheets(todaysDate)
Set dataRange = ws.Range(“A3:I” & ws.Cells(ws.Rows.Count, “A”).End(xlUp).Row)

‘ Step 13: Create the pivot table in the new sheet
Set pivotTbl = pivotWs.PivotTables.Add(PivotCache:=ThisWorkbook.PivotCaches.Create( _
SourceType:=xlDatabase, SourceData:=dataRange), TableDestination:=pivotWs.Cells(1, 1))

‘ Step 14-19: Add fields to the pivot table and format them
With pivotTbl
‘ Add “Owning Area” to rows
.PivotFields(“Owning Area”).Orientation = xlRowField

‘ Add “Num of Chg Sess” to values as a sum
With .PivotFields(“Num of Chg Sess”)
.Orientation = xlDataField
.Function = xlSum
End With

‘ Add “Amt on Chg Rvw” to values as a sum
With .PivotFields(“Amt on Chg Rvw”)
.Orientation = xlDataField
.Function = xlSum
End With

‘ Add “Avg Svc Dt Age” to values as an average
With .PivotFields(“Avg Svc Dt Age”)
.Orientation = xlDataField
.Function = xlAverage
End With

‘ Add “Avg Age” to values as an average
With .PivotFields(“Avg Age”)
.Orientation = xlDataField
.Function = xlAverage
End With
End With

‘ Step 20: Format columns B, D, and E with custom number format to show dashes instead of zeros
pivotWs.Columns(2).NumberFormat = “#,##0;-#,##0;–”
pivotWs.Columns(4).NumberFormat = “#,##0;-#,##0;–”
pivotWs.Columns(5).NumberFormat = “#,##0;-#,##0;–”

‘ Step 21: Format column C as currency with no decimals
pivotWs.Columns(3).NumberFormat = “$#,##0”

End Sub
    Read More

​

We are excited to announce a new Microsoft Defender for Identity sensor for Entra Connect servers. This addition is a significant step in our ongoing commitment to expanding Defender for Identity’s coverage across hybrid identity environments. It reinforces our vision of overseeing and protecting the entire identity fabric, greatly enhancing the SOC’s visibility and protections for these complex environments.

Identities are one of, if not the most targeted attack vector and cyber-criminals are always evolving their strategies to exploit new vulnerabilities or gaps in protection. Many organizations today manage hybrid identity environments, with an on-premises Active Directory footprint along with a deployment of Entra ID in the cloud. The gaps between these two elements present ample opportunities for bad actors and as the primary bridge between them, Entra Connect servers can be classified as tier-0 level assets.  

To stay ahead of emerging threats and deliver powerful security solutions, our team is continuously evolving and updating our offerings, and the primary objective of this new sensor is to help our customers better prevent, detect, and remediate credential theft and privilege escalation attacks commonly initiated against Entra Connect.

What is Entra Connect? What security value does the new sensor provide?

Entra Connect (previously known as Azure AD Connect or AAD Connect) is a Microsoft service used to synchronize on-premises Active Directory environments with Entra ID (formerly Azure Active Directory). Entra Connect facilitates identity management and provides single sign-on capabilities for users across on-premises and cloud resources by creating a common identity. This synchronization is essential for maintaining consistent and secure access across different platforms.

The new Microsoft Defender for Identity sensor for Entra Connect servers provides comprehensive monitoring of synchronization activities between Entra Connect and Active Directory, offering crucial insights into potential security threats and unusual activities. With this enhanced visibility across hybrid identity environments Defender for Identity can now provide new Entra Connect specific security alerts and posture recommendations, as detailed below.

Entra Connect sensor on Identities Settings page

New Detections (in Public Preview):

Suspicious Interactive Logon to the Entra Connect Server:

Direct logins to Entra Connect servers are highly unusual and potentially malicious. Attackers often target these servers to steal credentials for broader network access. Microsoft Defender for Identity can now detect abnormal logins to Entra Connect servers, helping you identify and respond to these potential threats faster. It is specifically applicable when the Entra Connect server is a standalone server and not operating as a Domain Controller.

Pre-requisite: Ensure that the 4624 logon event is enabled on the Entra Connect server. This step is necessary only if the Entra Connect server is not functioning as a Domain Controller.

User Password Reset by Entra Connect Account:
The Entra Connect connector account often holds high privileges, including the ability to reset user’s passwords. Microsoft Defender for Identity now has visibility into those actions and will detect any usage of those permissions that were identified as malicious and non-legitimate. This alert will be triggered only if the password writeback feature is disabled.

Suspicious writeback by Entra Connect on a sensitive user:

While Entra Connect already prevents writeback for users in privileged groups, Microsoft Defender for Identity expands this protection by identifying additional types of sensitive accounts. This enhanced detection helps prevent unauthorized password resets on critical accounts, which can be a crucial step in advanced attacks targeting both cloud and on-premises environments.

Additional improvements and capabilities:

New activity of any failed password reset on a sensitive account available in the ‘IdentityDirectoryEvents’ table in Advanced Hunting. This can help customers track failed password reset events and create custom detection based on this data.
Enhanced accuracy for the DC sync attack detection.
New health alert for cases where the sensor is unable to retrieve the configuration from the Entra Connect service.
Extended monitoring for security alerts, such as PowerShell Remote Execution Detector, by enabling the new sensor on Entra Connect servers.

New posture recommendations in Microsoft Secure Score (Identity security assessment):

Rotate password for Entra Connect connector account:
A compromised Entra Connect connector account (AD DS connector account, commonly shown as MSOL_XXXXXXXX) can grant access to high-privilege functions like replication and password resets, allowing attackers to modify synchronization settings and compromise security in both cloud and on-premises environments as well as offering several paths for compromising the entire domain. In this assessment we recommend customers change the password of MSOL accounts with the password last set over 90 days ago.

Remove unnecessary replication permissions for Entra Connect Account:
By default, the Entra Connect connector account has extensive permissions to ensure proper synchronization (even if they are not actually required). If Password Hash Sync is not configured, it’s important to remove unnecessary permissions to reduce the potential attack surface.

Change password for Entra seamless SSO account configuration:
This report lists all Entra seamless SSO computer accounts with password last set over 90 days ago. The password for the Azure SSO computer account is not automatically changed every 30 days. If an attacker compromises this account, they can generate service tickets for the AZUREADSSOACC account on behalf of any user and impersonate any user in the Entra tenant that is synchronized from Active Directory. An attacker can use this to move laterally from Active Directory into Entra ID.

Remove Resource Based Constrained Delegation for Entra seamless SSO account:
If resource-based constrained delegation is configured on the AZUREADSSOACC computer account, an account with the delegation would be able to generate service tickets for the AZUREADSSOACC account on behalf of any user and impersonate any user in the Entra tenant that is synchronized from AD.

All new recommendations require a sensor installed on servers running Entra Connect services.
The recommendations related to the Entra seamless SSO account will be available only if Defender for Identity can detect this type of computer account, while the recommendations related to the connector account will be available if our sensor recognized a retrieve configuration data from the Entra Connect services.

New Entra Connect recommendations in Microsoft Secure Score

As cyber threats become more sophisticated, the need for advanced security solutions is more pressing than ever. The new sensor for Entra Connect Server within Microsoft Defender for Identity represents a significant advancement in protecting and detecting threats within the identity fabric. By adopting this powerful tool, organizations can enhance their security posture, safeguard their identity infrastructure, and maintain the trust of their users.

We highly recommend customers install a sensor on any Domain controller, AD CS, AD FS, or Entra Connect servers. In the upcoming weeks, our team will delve deeper into potential enhancements for the Entra Connect support to better help organizations stay secure and protected.

Learn more about the new sensor in our documentation here and stay tuned for more updates and insights on how MDI continues to innovate in the realm of cybersecurity, ensuring that your organization remains secure in an ever-changing digital world.

​Microsoft Tech Community – Latest Blogs –Read More 

Join the Microsoft Planner product team on Tuesday, September 17 at 9:00 AM Pacific to learn about recent updates to the Planner app, and get a sneak peek at what’s coming next, followed by a live Ask Microsoft Anything. Our product experts will showcase key new features and improvements of the new experience, including demonstrations of how to leverage Copilot in Planner, new Baselines to stay on track, web app updates, integration with Whiteboard, and more. The event includes a live Q&A session where you can ask the team any questions about these updates.

The AMA event on Tuesday is your chance to see the latest features of Planner and hear directly from the product team. This 60-minute session is an opportunity to ask open questions and provide feedback about the new Microsoft Planner. Register today!

Please note, if you cannot attend the live AMA, you can ask questions at any time via the event page—see Comments section. Our team will address all questions during the event, so check back for answers.

​Microsoft Tech Community – Latest Blogs –Read More 

In this blog post I am going to talk about splitting logs to multiple tables and opting for basic tier to save cost in Microsoft Sentinel. Before we delve into the details, let’s try to understand what problem we are going to solve with this approach.

Azure Monitor offers several log plans which our customers can opt for depending on their use cases. These log plans include:

Analytics Logs – This plan is designed for frequent, concurrent access and supports interactive usage by multiple users. This plan drives the features in Azure Monitor Insights and powers Microsoft Sentinel. It is designed to manage critical and frequently accessed logs optimized for dashboards, alerts, and business advanced queries.
Basic Logs – Improved to support even richer troubleshooting and incident response with fast queries while saving costs. Now available with a longer retention period and the addition of KQL operators to aggregate and lookup.
Auxiliary Logs – Our new, inexpensive log plan that enables ingestion and management of verbose logs needed for auditing and compliance scenarios. These may be queried with KQL on an infrequent basis and used to generate summaries.

Following diagram provides detailed information about the log plans and their use cases:

I would also recommend going through our public documentation for detailed insights about feature-wise comparison for the log plans which should help you in taking right decisions for choosing the correct log plans.

**Note** Auxiliary logs are out of scope for this blog post, I will write a separate blog on the Auxiliary logs later.

So far, we know about different log plans available and their use cases.

 The next question is which tables support Analytics and Basic log plan?

Analytics Logs: All tables support the Analytics plan.
Basic Logs: All DCR-based custom tables and some Azure tables support the Basic log plan.

You can switch between the Analytics and Basic plans; the change takes effect on existing data in the table immediately.

When you change a table’s plan from Analytics to Basic, Azure monitor treats any data that’s older than 30 days as long-term retention data based on the total retention period set for the table. In other words, the total retention period of the table remains unchanged, unless you explicitly modify the long-term retention period.

Check our public documentation for more information on setting the table plan.

I will focus on splitting Syslog table and setting up the DCR-based table to Basic tier in this blog.

Typically Firewall logs contribute to high volume of log ingestion to a SIEM solution.

In order to manage cost in Microsoft Sentinel its highly recommended to thoroughly review the logs and identify which logs can be moved to Basic log plan.

At a high level, the following steps should be enough to achieve this task:

Ingest Firewall logs to Microsoft Sentinel with the help of Linux Log Forwarder via Azure Monitor Agent.
Assuming the log is getting ingested in Syslog table, create a custom table with same schema as Syslog table.
Update the DCR template to split the logs.
Set the table plan to Basic for the identified DCR-based custom table.
Set the required retention period of the table.

At this point, I anticipate you already have log forwarder set up and able to ingest Firewall logs to Microsoft Sentinel’s workspace.

Let’s focus on creating a custom table now

This part used to be cumbersome but not anymore, thanks to my colleague Marko Lauren who has done a fantastic job in creating this PowerShell Script which can create a custom table easily. All you need to do is to enter the pre-existing table name and the script will create a new DCR-Based custom table with same schema.

Let’s see it in action:

Download the script locally.
Open the script in PowerShell ISE and update workspace ID & resource ID details as shown below.

Save it locally and upload to Azure PowerShell.
Load the file and enter the table name from which you wish to copy the schema.
Provide the new table name as per your wish, ensure the name has suffix “_CL” as shown below:

This should create a new DCR-based custom table which you can check in Log Analytics Workspace > Table blade as shown below:

**Note** We highly recommend you should review the PowerShell script thoroughly and do proper testing before executing it in production. We don’t take any responsibility for the script.

The next step is to update the Data Collection Rule template to split the logs

Since we already created custom table, we should create a transformation logic to split the logs and send less relevant log to the custom table which we are going to set to Basic log tier.

For demo purposes, I’m going to split logs based on SeverityLevel. I will drop “info” logs from Syslog table and stream it to Syslog_CL table.

Let’s see how it works:

Browse to Data Collection Rule blade.
Open the DCR for Syslog table, click on Export template > Deploy > Edit Template as shown below:

In the dataFlows section, I’ve created 2 streams for splitting the logs. Details about the streams as follows:

1st Stream: It’s going to drop the Syslog messages where SeverityLevel is “info” and send the logs to Syslog table.
2nd Stream: It’s going to capture all Syslog messages where SeverityLevel is “info” and send the logs to Syslog_CL table.

Save and deploy.

Let’s validate if it really works

Go to the Log Analytics Workspace > Logs and check if the tables contains the data which we have defined it for.

In my case as we can see, Syslog table contains all logs except those where SeverityLevel is “info”

Additionally, our custom table: Syslog_CL contains those Syslog data where SeverityLevel is “info”

Now the next part is to set the Syslog_CL table to Basic log plan

Since Syslog_CL is a DCR-based custom table, we can set it to Basic log plan. Steps are straightforward:

Go to the Log Analytics Workspace > Tables
Search for the table: Syslog_CL
Click on the ellipsis on the right side and click on Manage table as shown below:

Select the table plan to Basic and set desired retention period

Save the settings.

Now you can enjoy some cost benefits, hope this helps.

​Microsoft Tech Community – Latest Blogs –Read More