FalconForce Official

FalconForce will join @1ns0mn1h4ck again in February 2027. This training equips you with the tools and frameworks needed to build, maintain, and evolve a proactive security program. Tickets and registration: insomnihack.ch/session/a8c02…

We have created KQL hunting queries to get you started figuring out whether you are affected by the latest PHP and certificate vulnerabilities. 👉 github.com/FalconForceTeam/F… We want to say thank you to all defenders and responders resolving these issues 🫶

That’s the thinking behind Sentry Respond. AI assists. Defined playbooks control response. Actions are logged. And it runs in your Azure environment, with your choice of models and data sources. The question isn’t “Does it use AI?” It’s “Where should AI have control?” (2/2)

When an alert fires, Sentry Respond gets to work before the analyst opens the incident. Enrichment. Normalised entities. Investigation context. Response actions. Automated closure where appropriate. More detections ≠ better response. We engineer both. falconforce.nl/services/blue…

This is the problem Sentry Respond is designed to address. Not by making your Logic Apps or SOAR estate obsolete, but by bringing code-first development, logging, health monitoring and clearer ownership to incident-response automation. (2/2)

Sentry Respond cuts average incident-handling time from 60+ minutes to roughly 15 by putting enrichment, prioritization and response actions alongside Defender XDR. Don’t automate the judgement. Remove the work slowing it down. (2/2)

Last weekend, we were at #BalCCon 2k26 conference in Novi Sad, Serbia. Our colleague Nikos Mantas facilitated the workshop “Memory Forensics in the age of EDR”. We had great discussions with the participants. And really enjoyed the ambiance of this event.

Detection performance shouldn’t be buried across alerts and metrics. 📊 In our latest blog, we introduce and open-source #FalconDash - a modular dashboard built to make Microsoft Sentinel detection performance visible, explorable, and easier to tune. 🚀 falconforce.nl/introducing-f…

Are you a security professional that works with Microsoft Security solutions? #Yellowhat conference. January 19, Almere, NL. Want a 5-hour hands-on detection-engineering workshop with FalconForce? Add our Advanced Detection Engineering training: yellowhat.live/

Historically, offensive and defensive teams have been competitors, eyeballing each other with suspicion. This approach has been suboptimal. Givan Kolster will highlight his insights into the benefits of purple teaming at #CyberHagen, September 17. Info: cyberhagen.com

What if you could leverage Event Tracing for Windows (ETW) to manipulate telemetry data, challenging the trust placed in endpoint detection and response (EDR) tools? 👉 Have a look at our latest blog as presented earlier at Black Hat by @olafhartong: falconforce.nl/in-your-logs-…

SOC maturity isn't measured by the number of tools, but by how well they work together under pressure. For CISOs, the real question is: where does incident response still depend on manual investigations or individual expertise? (2/2)

Your SOC probably doesn't need just another security tool. Most SOCs don't have a tooling problem. They have an orchestration problem. Response slows when context gathering, prioritization and handoffs remain fragmented. (1/2)