I will deploy or tune microsoft sentinel with kql detections and defender xdr

Your SIEM should cut incidents, not multiply them. I deploy new Microsoft Sentinel workspaces and fix existing ones that drown analysts in noise or burn budget on ingestion.

What I do: health checks (silent rules, duplicate Defender XDR incidents, ingestion cost by table and source), custom KQL analytics rules mapped to MITRE ATT&CK with full entity mapping, false-positive tuning with watchlists instead of switching rules off, Logic Apps playbooks for enrichment and containment, and complete greenfield deployments with connectors, workbooks and documented handover.

Every rule is validated against simulated attacks before handover, and everything ships as ARM templates in Git so your team can review and roll back.

Background: AZ-500 certified, 2 years in Azure Security Premier Support handling Sentinel and Defender cases with Microsoft product teams. No production change without your written approval. NDA welcome.