CONTEXT
Practising the work behind a SOC alert.
The project was designed to move beyond tool familiarity and practise a complete detection workflow: bring security-relevant logs into a SIEM, interrogate the data, create detection logic and investigate resulting incidents.
SECURITY RISK
Logs only create value when they can support timely detection and investigation.
Identity activity can reveal suspicious sign-ins, unusual authentication patterns and behaviours that may indicate account compromise. The technical challenge is to ensure that useful telemetry is available, queryable and connected to an investigation workflow.
Ingest Azure identity activity so analysts have data to investigate.
Transform raw log data into targeted threat hunting and detection logic.
Create conditions that allow the alerting workflow to be tested.
Review evidence and establish a defensible incident narrative.
IMPLEMENTATION
From log source to investigation.
- Configured log ingestion from Azure identity sources into Microsoft Sentinel.
- Used Kusto Query Language to inspect and filter security-relevant events.
- Developed custom queries for threat detection and analyst investigation.
- Simulated an incident path to validate how alerts surface for review.
- Captured dashboard and alert evidence in the public project repository.
DETECTION LOGIC
KQL as the bridge between telemetry and analyst action.
The portfolio version of this project should continue to evolve from screenshots into documented detection engineering. Each query should explain the hypothesis, relevant fields, thresholds, expected false positives and how an analyst would validate the result.
VALIDATION
Evidence that the workflow works.
The current repository documents a Microsoft Sentinel dashboard and a sample incident alert. The next maturity step is to add query-specific screenshots, a detection test matrix and a short investigation timeline for each simulated scenario.
LESSONS & NEXT ITERATION
Make detections explainable, testable and useful to another analyst.
The strongest version of this lab is not the one with the most alerts. It is the one where another analyst can understand why the detection exists, what evidence it uses, how it was tested and what action should follow.