Security Log Analysis

This project demonstrates how security event logs can be analyzed to identify suspicious activity and potential threats.

Objectives

• Analyze security event logs
• Identify anomalies and suspicious behavior
• Document investigation findings

Tools Used

• Microsoft Sentinel
• KQL queries
• Security event logs

Investigation Process

1. Collect log data
2. Query logs to identify anomalies
3. Investigate suspicious events
4. Document findings

Example Investigation

Suspicious login attempts were identified from an unfamiliar IP address outside normal login hours. Queries were used to analyze authentication events and confirm abnormal behavior patterns.