Microsoft Sentinel SIEM Lab

From Windows Logon Failure to Automated Security Incident Detection

Project Overview

One of the most valuable skills for a Security Operations Center (SOC) analyst is understanding how a single Windows security event becomes a meaningful security incident. In this project I built an end-to-end Microsoft Sentinel lab demonstrating the complete detection pipeline—from Windows event collection to automated incident generation.

Why I Built This Lab

Modern SOC teams cannot manually review every Windows event. This lab demonstrates how Microsoft Sentinel centralizes telemetry, analyzes Windows Security Events, and automatically generates security incidents using custom analytics rules.

Lab Environment

Implementation Summary

I deployed a Resource Group, Log Analytics Workspace and Microsoft Sentinel, connected a Windows endpoint using Azure Arc, installed Azure Monitor Agent, configured Windows Security Events, verified SecurityEvent ingestion using KQL, created an analytics rule for failed logons, and successfully generated a Microsoft Sentinel incident.

Skills Demonstrated

Project Screenshots

Azure Portal Home
Figure 1 — Azure Portal Home.
Resource Group Created
Figure 2 — Resource Group Created.
Log Analytics Workspace Created
Figure 3 — Log Analytics Workspace Created.
Windows Security Events Connector Installed
Figure 4 — Windows Security Events Connector Installed.
Data Collection Rule Configured
Figure 5 — Data Collection Rule Configured.
Azure Arc Onboarding Successful
Figure 6 — Azure Arc Onboarding Successful.
Azure Arc Machine Connected
Figure 7 — Azure Arc Machine Connected.
Azure Monitor Agent Installed
Figure 8 — Azure Monitor Agent Installed.
Security Event Data Received
Figure 9 — Security Event Data Received.
Analytics Rule Created
Figure 10 — Analytics Rule Created.
KQL Query Detecting Failed Logon Attempts
Figure 11 — KQL Query Detecting Failed Logon Attempts.
Microsoft Sentinel Incident Created
Figure 12 — Microsoft Sentinel Incident Created.

Conclusion

This project strengthened my understanding of Microsoft Sentinel, Azure monitoring, Windows event collection, KQL queries, and the complete workflow from failed Windows logon attempts to automated incident generation.

← Back to Portfolio