@misc{one-event-three-portals-how-a-single-sysmon-line-becomes-a-m,
  author    = {Parag Mali},
  title     = {One Event, Three Portals: How a Single Sysmon Line Becomes a Microsoft Defender XDR Incident},
  year      = {2026},
  month     = {06},
  day       = {04},
  url       = {https://paragmali.com/blog/one-event-three-portals-how-a-single-sysmon-line-becomes-a-m/},
  howpublished = {\url{https://paragmali.com/blog/one-event-three-portals-how-a-single-sysmon-line-becomes-a-m/}},
  note      = {Accessed: 2026-06-04}
}