This project demonstrates hands-on Security Operations Center (SOC) workflows using Microsoft Sentinel and Microsoft Azure.
The objective of this lab is to simulate real-world SOC operations, including threat detection, investigation, incident response, and threat hunting using Kusto Query Language (KQL).
- Deploy Microsoft Sentinel
- Configure Azure Log Analytics Workspace
- Practice KQL queries
- Detect common attack techniques
- Map detections to MITRE ATT&CK
- Create analytics rules
- Perform threat hunting
- Build investigation reports
- Document incident response procedures
Azure Subscription
│
▼
Log Analytics Workspace
│
▼
Microsoft Sentinel
│
▼
Data Connectors
│
▼
Analytics Rules
│
▼
Incidents
│
▼
Threat Hunting
│
▼
Workbooks & Reports
Microsoft-Sentinel-SOC-Lab
│
├── README.md
├── screenshots/
├── kql/
├── analytics_rules/
├── hunting/
├── workbooks/
├── reports/
└── playbooks/
This repository currently includes detection queries for:
- Failed Logins
- Successful Logins
- Brute Force Detection
- Password Spray Detection
- Impossible Travel
- Risky Sign-ins
- MFA Failures
- Credential Dumping
- Mimikatz Detection
- Encoded PowerShell
- Scheduled Tasks
- Top Security Alerts
- Ransomware Activity
| Technique | Description |
|---|---|
| T1110 | Brute Force |
| T1078 | Valid Accounts |
| T1059.001 | PowerShell |
| T1003 | Credential Dumping |
| T1053 | Scheduled Task |
| T1486 | Data Encrypted for Impact |
- Microsoft Sentinel
- Microsoft Defender
- Azure Log Analytics
- Azure Monitor
- Kusto Query Language (KQL)
- Microsoft Azure
- MITRE ATT&CK Framework
- SIEM Administration
- Threat Detection
- Threat Hunting
- Incident Investigation
- KQL Query Development
- MITRE ATT&CK Mapping
- Security Monitoring
- Azure Security
Agata Gabara