CONTEXT
Practise the work behind a SOC alert, not just the interface.
The project is designed around the full analyst chain: useful identity telemetry, a documented detection hypothesis, query execution, alert/incident generation, investigation, false-positive analysis, response guidance and a defensible evidence record.
DET-001
Repeated failed Microsoft Entra ID sign-ins.
The current implemented detection identifies more than five invalid-password events grouped by source IP and user principal name. Its documentation includes the threat hypothesis, SigninLogs data source, MITRE ATT&CK mapping to T1110 Brute Force, analyst triage questions, false-positive considerations, response guidance and production limitations.
INCIDENT INVESTIGATION
Turn a matched threshold into an analyst decision.
The repository now includes an INC-001 runbook and investigation queries for failure confirmation, chronological sign-in timeline, success-after-failure correlation, same-source cross-user activity and DET-001 validation.
The incident record defines the hypothesis, expected result, evidence requirements and final-disposition logic before tenant evidence is collected.
REPOSITORY QUALITY
Make the evidence structure repeatable.
GitHub Actions validates required detection documentation, filename hygiene, incident/evidence structure and portfolio-lab disclosures. The quality workflow is green, giving reviewers evidence that the repository has repeatable controls rather than static screenshots alone.
VALIDATION STATUS
Do not call simulated evidence complete until it exists.
INC-001 is intentionally still open. The remaining evidence requires a controlled lab identity, six invalid-password attempts, the resulting DET-001 query result, a Sentinel incident and an investigation timeline from the authorised Azure tenant.
That evidence will complete the chain: controlled event → telemetry → KQL detection → Sentinel incident → investigation → analyst decision.
LESSONS
The strongest detection is one another analyst can understand, test and challenge.
This project has evolved from a small KQL-and-screenshot lab into a documented security-engineering workflow. The next maturity step is real controlled validation, followed by tuning the threshold and adding stronger correlation logic rather than increasing rule count for appearance.