Work / SOC & Threat Hunting

Azure SOC Home Lab

A SOC lab in Microsoft Sentinel monitoring 10+ telemetry sources, with KQL detections mapped to MITRE ATT&CK that surfaced 1,000+ malicious logon attempts.

Category
SOC & Threat Hunting
Stack
Microsoft Sentinel · KQL · MITRE ATT&CK

A security operations lab built on Microsoft Sentinel to practise the full detect-and-respond loop across endpoint, cloud and network telemetry.

  • Built a SOC lab monitoring endpoint, cloud, and network telemetry in Microsoft Sentinel (SIEM) across 10+ sources, detecting, analyzing, and responding to potential threats.
  • Authored KQL detections mapped to MITRE ATT&CK and ran log/IOC-based threat hunting, surfacing 1,000+ malicious logon attempts and driving incident response.
  • Documented detection logic and response procedures on GitHub, aligned to NIST and security best practices.