[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADXXNGZNDNBGS4YXC3NH79":3,"skill-same:01M6ADXXNGZNDNBGS4YXC3NH79":112},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":71,"commitSha":72,"skillDirectory":73,"forksCount":74,"repositoryHtmlUrl":75,"repositoryHomepageUrl":76,"ownerHtmlUrl":77,"ownerBlogUrl":78,"ownerDescription":79,"updatedAt":80,"install":81,"resources":94},"01M6ADXXNGZNDNBGS4YXC3NH79","building-cloud-siem-with-sentinel",null,"Deploy Microsoft Sentinel as a cloud-native SIEM\u002FSOAR by configuring multi-cloud data connectors (AWS, Azure, GCP), writing KQL detection and hunting queries, and building automated Logic Apps response playbooks. Use when establishing a centralized SOC for multi-cloud environments, migrating from a legacy SIEM, or performing petabyte-scale threat hunting; not for AWS-only setups where Security Hub\u002FGuardDuty suffice or for endpoint EDR needs.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-cloud-siem-with-sentinel\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"cloud","building cloud siem with sentinel","siem","cloud-security","cybersecurity","soar-automation","kql-queries","cloud-siem","microsoft-sentinel","gcp","threat-detection","soc","writing","kql","pr","azure","connectors","automation","threat hunting","soar","2026-11-10 10:12:30",false,"---\nname: building-cloud-siem-with-sentinel\ndescription: Deploy Microsoft Sentinel as a cloud-native SIEM\u002FSOAR by configuring multi-cloud data connectors (AWS, Azure, GCP), writing KQL detection and hunting queries, and building automated Logic Apps response playbooks. Use when establishing a centralized SOC for multi-cloud environments, migrating from a legacy SIEM, or performing petabyte-scale threat hunting; not for AWS-only setups where Security Hub\u002FGuardDuty suffice or for endpoint EDR needs.\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- microsoft-sentinel\n- cloud-siem\n- kql-queries\n- soar-automation\n- threat-detection\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\natlas_techniques:\n- AML.T0070\n- AML.T0066\n- AML.T0082\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1078.004\n- T1548.005\n- T1485\n- T1530\n- T1021.007\n---\n\n# Building Cloud SIEM with Sentinel\n\n## When to Use\n\n- When establishing a centralized security operations center for multi-cloud environments\n- When migrating from legacy SIEM platforms (Splunk, QRadar) to cloud-native architecture\n- When building automated incident response workflows for cloud-specific threats\n- When performing large-scale threat hunting across petabytes of security telemetry\n- When integrating threat intelligence feeds with cloud security log analysis\n\n**Do not use** for AWS-only environments where Security Hub and GuardDuty suffice, for endpoint detection requiring EDR capabilities (use Defender for Endpoint), or for compliance posture monitoring (see building-cloud-security-posture-management).\n\n## Prerequisites\n\n- Azure subscription with Microsoft Sentinel enabled on a Log Analytics workspace\n- Data connector permissions for target log sources (AWS CloudTrail, Azure Activity, GCP)\n- Logic Apps or Azure Functions for automated response playbooks\n- KQL (Kusto Query Language) proficiency for writing detection rules and hunting queries\n\n## Workflow\n\n### Step 1: Provision Sentinel Workspace and Data Connectors\n\nCreate a Log Analytics workspace optimized for security data and enable data connectors for multi-cloud ingestion.\n\n```powershell\n# Create Log Analytics workspace\naz monitor log-analytics workspace create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --location eastus \\\n  --retention-time 365 \\\n  --sku PerGB2018\n\n# Enable Microsoft Sentinel on the workspace\naz sentinel onboarding-state create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace\n\n# Enable AWS CloudTrail connector\naz sentinel data-connector create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --data-connector-id aws-cloudtrail \\\n  --kind AmazonWebServicesCloudTrail \\\n  --aws-cloud-trail-data-connector '{\n    \"awsRoleArn\": \"arn:aws:iam::123456789012:role\u002FSentinelCloudTrailRole\",\n    \"dataTypes\": {\"logs\": {\"state\": \"Enabled\"}}\n  }'\n\n# Enable Azure AD sign-in and audit logs\naz sentinel data-connector create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --data-connector-id azure-ad \\\n  --kind AzureActiveDirectory \\\n  --azure-active-directory '{\n    \"dataTypes\": {\n      \"alerts\": {\"state\": \"Enabled\"},\n      \"signinLogs\": {\"state\": \"Enabled\"},\n      \"auditLogs\": {\"state\": \"Enabled\"}\n    }\n  }'\n```\n\n### Step 2: Write KQL Detection Rules\n\nCreate analytics rules using Kusto Query Language to detect cloud-specific threats. Map each rule to MITRE ATT&CK techniques.\n\n```kql\n\u002F\u002F Detect impossible travel - sign-ins from geographically distant locations\nlet timeframe = 1h;\nlet distance_threshold = 500; \u002F\u002F km\nSigninLogs\n| where TimeGenerated > ago(timeframe)\n| where ResultType == 0 \u002F\u002F Successful sign-ins only\n| project TimeGenerated, UserPrincipalName, IPAddress, Location,\n          Latitude = toreal(LocationDetails.geoCoordinates.latitude),\n          Longitude = toreal(LocationDetails.geoCoordinates.longitude)\n| sort by UserPrincipalName asc, TimeGenerated asc\n| extend PrevLatitude = prev(Latitude, 1), PrevLongitude = prev(Longitude, 1),\n         PrevTime = prev(TimeGenerated, 1), PrevUser = prev(UserPrincipalName, 1)\n| where UserPrincipalName == PrevUser\n| extend TimeDiff = datetime_diff('minute', TimeGenerated, PrevTime)\n| where TimeDiff \u003C 60\n| extend Distance = geo_distance_2points(Longitude, Latitude, PrevLongitude, PrevLatitude) \u002F 1000\n| where Distance > distance_threshold\n| project TimeGenerated, UserPrincipalName, IPAddress, Location, Distance, TimeDiff\n```\n\n```kql\n\u002F\u002F Detect AWS IAM credential abuse from CloudTrail\nAWSCloudTrail\n| where TimeGenerated > ago(24h)\n| where EventName in (\"ConsoleLogin\", \"AssumeRole\", \"GetSessionToken\")\n| where ErrorCode == \"\"\n| summarize LoginCount = count(), DistinctIPs = dcount(SourceIpAddress),\n            IPList = make_set(SourceIpAddress, 10)\n            by UserIdentityArn, bin(TimeGenerated, 1h)\n| where DistinctIPs > 3\n| project TimeGenerated, UserIdentityArn, LoginCount, DistinctIPs, IPList\n```\n\n```kql\n\u002F\u002F Detect mass S3 object deletion (potential ransomware)\nAWSCloudTrail\n| where TimeGenerated > ago(1h)\n| where EventName == \"DeleteObject\" or EventName == \"DeleteObjects\"\n| summarize DeleteCount = count(), BucketsAffected = dcount(RequestParameters_bucketName)\n            by UserIdentityArn, bin(TimeGenerated, 10m)\n| where DeleteCount > 100\n| project TimeGenerated, UserIdentityArn, DeleteCount, BucketsAffected\n```\n\n### Step 3: Build SOAR Playbooks with Logic Apps\n\nCreate automated response playbooks that execute when analytics rules trigger incidents. Common actions include blocking users, isolating resources, and enriching alerts with threat intelligence.\n\n```json\n{\n  \"definition\": {\n    \"triggers\": {\n      \"Microsoft_Sentinel_incident\": {\n        \"type\": \"ApiConnectionWebhook\",\n        \"inputs\": {\n          \"body\": {\"incidentArmId\": \"subscriptions\u002F@{triggerBody()?['workspaceInfo']?['SubscriptionId']}\u002FresourceGroups\u002F@{triggerBody()?['workspaceInfo']?['ResourceGroupName']}\u002Fproviders\u002FMicrosoft.OperationalInsights\u002Fworkspaces\u002F@{triggerBody()?['workspaceInfo']?['WorkspaceName']}\u002Fproviders\u002FMicrosoft.SecurityInsights\u002FIncidents\u002F@{triggerBody()?['object']?['properties']?['incidentNumber']}\"},\n          \"host\": {\"connection\": {\"name\": \"@parameters('$connections')['microsoftsentinel']['connectionId']\"}}\n        }\n      }\n    },\n    \"actions\": {\n      \"Get_incident_entities\": {\n        \"type\": \"ApiConnection\",\n        \"inputs\": {\"method\": \"post\", \"path\": \"\u002FIncidents\u002Fentities\"}\n      },\n      \"For_each_account_entity\": {\n        \"type\": \"Foreach\",\n        \"foreach\": \"@body('Get_incident_entities')?['Accounts']\",\n        \"actions\": {\n          \"Disable_Azure_AD_user\": {\n            \"type\": \"ApiConnection\",\n            \"inputs\": {\n              \"method\": \"PATCH\",\n              \"path\": \"\u002Fv1.0\u002Fusers\u002F@{items('For_each_account_entity')?['AadUserId']}\",\n              \"body\": {\"accountEnabled\": false}\n            }\n          },\n          \"Add_comment_to_incident\": {\n            \"type\": \"ApiConnection\",\n            \"inputs\": {\n              \"body\": {\"message\": \"User @{items('For_each_account_entity')?['Name']} disabled by automated playbook\"}\n            }\n          }\n        }\n      }\n    }\n  }\n}\n```\n\n### Step 4: Configure Sentinel Data Lake for Long-Term Hunting\n\nEnable the Sentinel data lake for petabyte-scale log retention and advanced threat hunting using both KQL and SQL endpoints.\n\n```kql\n\u002F\u002F Threat hunting query: detect lateral movement across AWS accounts\nlet suspicious_roles = AWSCloudTrail\n| where TimeGenerated > ago(7d)\n| where EventName == \"AssumeRole\"\n| extend AssumedRoleArn = tostring(parse_json(RequestParameters).roleArn)\n| where AssumedRoleArn contains \"cross-account\" or AssumedRoleArn contains \"admin\"\n| summarize AssumeCount = count(), UniqueSourceAccounts = dcount(RecipientAccountId)\n            by UserIdentityArn, AssumedRoleArn\n| where AssumeCount > 10 and UniqueSourceAccounts > 2;\nsuspicious_roles\n| join kind=inner (\n    AWSCloudTrail\n    | where TimeGenerated > ago(7d)\n    | where EventName in (\"RunInstances\", \"CreateFunction\", \"PutBucketPolicy\")\n) on UserIdentityArn\n| project TimeGenerated, UserIdentityArn, AssumedRoleArn, EventName, SourceIpAddress\n```\n\n### Step 5: Integrate Threat Intelligence\n\nConnect threat intelligence providers and create indicator-based matching rules to detect communication with known malicious infrastructure.\n\n```powershell\n# Enable Microsoft Threat Intelligence connector\naz sentinel data-connector create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --data-connector-id microsoft-ti \\\n  --kind MicrosoftThreatIntelligence \\\n  --microsoft-threat-intelligence '{\n    \"dataTypes\": {\"microsoftEmergingThreatFeed\": {\"lookbackPeriod\": \"2025-01-01T00:00:00Z\", \"state\": \"Enabled\"}}\n  }'\n```\n\n```kql\n\u002F\u002F Match network indicators against cloud flow logs\nlet TI_IPs = ThreatIntelligenceIndicator\n| where TimeGenerated > ago(30d)\n| where isnotempty(NetworkIP)\n| distinct NetworkIP;\nAzureNetworkAnalytics_CL\n| where TimeGenerated > ago(24h)\n| where DestIP_s in (TI_IPs)\n| project TimeGenerated, SrcIP_s, DestIP_s, DestPort_d, FlowType_s\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| KQL | Kusto Query Language, the primary query language for Microsoft Sentinel used to search, analyze, and visualize security data |\n| Analytics Rule | Detection logic in Sentinel that evaluates log data on a schedule and creates incidents when conditions match |\n| SOAR Playbook | Automated workflow triggered by incidents that performs response actions such as blocking accounts, enriching alerts, or notifying teams |\n| Data Connector | Integration module that ingests security logs from cloud services, identity providers, and third-party tools into Sentinel |\n| Sentinel Data Lake | Petabyte-scale storage layer providing long-term log retention with KQL and SQL query interfaces for advanced hunting |\n| Workbook | Interactive dashboard in Sentinel displaying visualizations of security data, trends, and operational metrics |\n| Watchlist | Reference data tables in Sentinel used to enrich alerts with context such as VIP user lists or approved IP ranges |\n| Fusion Detection | Machine learning-powered correlation engine that automatically detects multi-stage attacks across data sources |\n\n## Tools & Systems\n\n- **Microsoft Sentinel**: Cloud-native SIEM\u002FSOAR platform built on Azure Log Analytics with AI-powered threat detection\n- **Azure Logic Apps**: Low-code automation platform for building SOAR playbooks triggered by Sentinel incidents\n- **Microsoft Threat Intelligence**: Integrated threat feeds providing IP, domain, and URL indicators for matching against security logs\n- **Azure Data Explorer**: High-performance analytics engine underlying Sentinel KQL queries for large-scale data exploration\n- **MITRE ATT&CK Navigator**: Framework for mapping Sentinel detection rules to adversary tactics and techniques\n\n## Common Scenarios\n\n### Scenario: Detecting Cross-Cloud Credential Theft Campaign\n\n**Context**: An attacker compromises an Azure AD account through phishing, then uses the account to access AWS resources via federated identity. Sentinel needs to correlate the Azure sign-in anomaly with unusual AWS API activity.\n\n**Approach**:\n1. Create an analytics rule detecting Azure AD impossible travel or anomalous sign-in risk\n2. Write a KQL query correlating the compromised Azure AD identity with AWS CloudTrail AssumeRoleWithSAML events\n3. Build a Fusion detection rule that links Azure AD risk events with subsequent AWS privilege escalation activity\n4. Deploy a SOAR playbook that automatically disables the Azure AD account and revokes AWS STS sessions\n5. Create a workbook showing the timeline from initial compromise through lateral movement to AWS\n6. Run a hunting query across the data lake to check for similar patterns affecting other accounts\n\n**Pitfalls**: Not correlating identity across cloud providers misses the full attack chain. Setting analytics rule frequency too low (e.g., 24 hours) allows attackers hours of undetected access.\n\n## Output Format\n\n```\nMicrosoft Sentinel SOC Operations Report\n==========================================\nWorkspace: sentinel-workspace\nData Sources: 14 connectors active\nReport Period: 2025-02-01 to 2025-02-23\n\nDATA INGESTION:\n  Azure AD Sign-in Logs:     2.3 TB (23 days)\n  AWS CloudTrail:            1.8 TB (23 days)\n  Azure Activity:            0.9 TB (23 days)\n  Defender for Cloud Alerts: 45 GB (23 days)\n  Total Ingestion:           5.1 TB\n\nDETECTION SUMMARY:\n  Active Analytics Rules: 87\n  Incidents Created: 234\n    Critical: 8 | High: 34 | Medium: 89 | Low: 103\n  Mean Time to Detect (MTTD): 4.2 minutes\n  Mean Time to Respond (MTTR): 18 minutes\n\nTOP INCIDENT TYPES:\n  Impossible Travel Detected:          42 incidents\n  AWS Unauthorized API Call Pattern:   28 incidents\n  Mass File Deletion in S3:            3 incidents\n  Suspicious Azure AD App Registration: 12 incidents\n\nAUTOMATION:\n  Playbooks Executed: 156\n  Accounts Auto-Disabled: 23\n  Incidents Auto-Enriched: 198\n  False Positive Rate: 12%\n```\n","# Building Cloud SIEM with Sentinel\n\n## When to Use\n\n- When establishing a centralized security operations center for multi-cloud environments\n- When migrating from legacy SIEM platforms (Splunk, QRadar) to cloud-native architecture\n- When building automated incident response workflows for cloud-specific threats\n- When performing large-scale threat hunting across petabytes of security telemetry\n- When integrating threat intelligence feeds with cloud security log analysis\n\n**Do not use** for AWS-only environments where Security Hub and GuardDuty suffice, for endpoint detection requiring EDR capabilities (use Defender for Endpoint), or for compliance posture monitoring (see building-cloud-security-posture-management).\n\n## Prerequisites\n\n- Azure subscription with Microsoft Sentinel enabled on a Log Analytics workspace\n- Data connector permissions for target log sources (AWS CloudTrail, Azure Activity, GCP)\n- Logic Apps or Azure Functions for automated response playbooks\n- KQL (Kusto Query Language) proficiency for writing detection rules and hunting queries\n\n## Workflow\n\n### Step 1: Provision Sentinel Workspace and Data Connectors\n\nCreate a Log Analytics workspace optimized for security data and enable data connectors for multi-cloud ingestion.\n\n```powershell\n# Create Log Analytics workspace\naz monitor log-analytics workspace create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --location eastus \\\n  --retention-time 365 \\\n  --sku PerGB2018\n\n# Enable Microsoft Sentinel on the workspace\naz sentinel onboarding-state create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace\n\n# Enable AWS CloudTrail connector\naz sentinel data-connector create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --data-connector-id aws-cloudtrail \\\n  --kind AmazonWebServicesCloudTrail \\\n  --aws-cloud-trail-data-connector '{\n    \"awsRoleArn\": \"arn:aws:iam::123456789012:role\u002FSentinelCloudTrailRole\",\n    \"dataTypes\": {\"logs\": {\"state\": \"Enabled\"}}\n  }'\n\n# Enable Azure AD sign-in and audit logs\naz sentinel data-connector create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --data-connector-id azure-ad \\\n  --kind AzureActiveDirectory \\\n  --azure-active-directory '{\n    \"dataTypes\": {\n      \"alerts\": {\"state\": \"Enabled\"},\n      \"signinLogs\": {\"state\": \"Enabled\"},\n      \"auditLogs\": {\"state\": \"Enabled\"}\n    }\n  }'\n```\n\n### Step 2: Write KQL Detection Rules\n\nCreate analytics rules using Kusto Query Language to detect cloud-specific threats. Map each rule to MITRE ATT&CK techniques.\n\n```kql\n\u002F\u002F Detect impossible travel - sign-ins from geographically distant locations\nlet timeframe = 1h;\nlet distance_threshold = 500; \u002F\u002F km\nSigninLogs\n| where TimeGenerated > ago(timeframe)\n| where ResultType == 0 \u002F\u002F Successful sign-ins only\n| project TimeGenerated, UserPrincipalName, IPAddress, Location,\n          Latitude = toreal(LocationDetails.geoCoordinates.latitude),\n          Longitude = toreal(LocationDetails.geoCoordinates.longitude)\n| sort by UserPrincipalName asc, TimeGenerated asc\n| extend PrevLatitude = prev(Latitude, 1), PrevLongitude = prev(Longitude, 1),\n         PrevTime = prev(TimeGenerated, 1), PrevUser = prev(UserPrincipalName, 1)\n| where UserPrincipalName == PrevUser\n| extend TimeDiff = datetime_diff('minute', TimeGenerated, PrevTime)\n| where TimeDiff \u003C 60\n| extend Distance = geo_distance_2points(Longitude, Latitude, PrevLongitude, PrevLatitude) \u002F 1000\n| where Distance > distance_threshold\n| project TimeGenerated, UserPrincipalName, IPAddress, Location, Distance, TimeDiff\n```\n\n```kql\n\u002F\u002F Detect AWS IAM credential abuse from CloudTrail\nAWSCloudTrail\n| where TimeGenerated > ago(24h)\n| where EventName in (\"ConsoleLogin\", \"AssumeRole\", \"GetSessionToken\")\n| where ErrorCode == \"\"\n| summarize LoginCount = count(), DistinctIPs = dcount(SourceIpAddress),\n            IPList = make_set(SourceIpAddress, 10)\n            by UserIdentityArn, bin(TimeGenerated, 1h)\n| where DistinctIPs > 3\n| project TimeGenerated, UserIdentityArn, LoginCount, DistinctIPs, IPList\n```\n\n```kql\n\u002F\u002F Detect mass S3 object deletion (potential ransomware)\nAWSCloudTrail\n| where TimeGenerated > ago(1h)\n| where EventName == \"DeleteObject\" or EventName == \"DeleteObjects\"\n| summarize DeleteCount = count(), BucketsAffected = dcount(RequestParameters_bucketName)\n            by UserIdentityArn, bin(TimeGenerated, 10m)\n| where DeleteCount > 100\n| project TimeGenerated, UserIdentityArn, DeleteCount, BucketsAffected\n```\n\n### Step 3: Build SOAR Playbooks with Logic Apps\n\nCreate automated response playbooks that execute when analytics rules trigger incidents. Common actions include blocking users, isolating resources, and enriching alerts with threat intelligence.\n\n```json\n{\n  \"definition\": {\n    \"triggers\": {\n      \"Microsoft_Sentinel_incident\": {\n        \"type\": \"ApiConnectionWebhook\",\n        \"inputs\": {\n          \"body\": {\"incidentArmId\": \"subscriptions\u002F@{triggerBody()?['workspaceInfo']?['SubscriptionId']}\u002FresourceGroups\u002F@{triggerBody()?['workspaceInfo']?['ResourceGroupName']}\u002Fproviders\u002FMicrosoft.OperationalInsights\u002Fworkspaces\u002F@{triggerBody()?['workspaceInfo']?['WorkspaceName']}\u002Fproviders\u002FMicrosoft.SecurityInsights\u002FIncidents\u002F@{triggerBody()?['object']?['properties']?['incidentNumber']}\"},\n          \"host\": {\"connection\": {\"name\": \"@parameters('$connections')['microsoftsentinel']['connectionId']\"}}\n        }\n      }\n    },\n    \"actions\": {\n      \"Get_incident_entities\": {\n        \"type\": \"ApiConnection\",\n        \"inputs\": {\"method\": \"post\", \"path\": \"\u002FIncidents\u002Fentities\"}\n      },\n      \"For_each_account_entity\": {\n        \"type\": \"Foreach\",\n        \"foreach\": \"@body('Get_incident_entities')?['Accounts']\",\n        \"actions\": {\n          \"Disable_Azure_AD_user\": {\n            \"type\": \"ApiConnection\",\n            \"inputs\": {\n              \"method\": \"PATCH\",\n              \"path\": \"\u002Fv1.0\u002Fusers\u002F@{items('For_each_account_entity')?['AadUserId']}\",\n              \"body\": {\"accountEnabled\": false}\n            }\n          },\n          \"Add_comment_to_incident\": {\n            \"type\": \"ApiConnection\",\n            \"inputs\": {\n              \"body\": {\"message\": \"User @{items('For_each_account_entity')?['Name']} disabled by automated playbook\"}\n            }\n          }\n        }\n      }\n    }\n  }\n}\n```\n\n### Step 4: Configure Sentinel Data Lake for Long-Term Hunting\n\nEnable the Sentinel data lake for petabyte-scale log retention and advanced threat hunting using both KQL and SQL endpoints.\n\n```kql\n\u002F\u002F Threat hunting query: detect lateral movement across AWS accounts\nlet suspicious_roles = AWSCloudTrail\n| where TimeGenerated > ago(7d)\n| where EventName == \"AssumeRole\"\n| extend AssumedRoleArn = tostring(parse_json(RequestParameters).roleArn)\n| where AssumedRoleArn contains \"cross-account\" or AssumedRoleArn contains \"admin\"\n| summarize AssumeCount = count(), UniqueSourceAccounts = dcount(RecipientAccountId)\n            by UserIdentityArn, AssumedRoleArn\n| where AssumeCount > 10 and UniqueSourceAccounts > 2;\nsuspicious_roles\n| join kind=inner (\n    AWSCloudTrail\n    | where TimeGenerated > ago(7d)\n    | where EventName in (\"RunInstances\", \"CreateFunction\", \"PutBucketPolicy\")\n) on UserIdentityArn\n| project TimeGenerated, UserIdentityArn, AssumedRoleArn, EventName, SourceIpAddress\n```\n\n### Step 5: Integrate Threat Intelligence\n\nConnect threat intelligence providers and create indicator-based matching rules to detect communication with known malicious infrastructure.\n\n```powershell\n# Enable Microsoft Threat Intelligence connector\naz sentinel data-connector create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --data-connector-id microsoft-ti \\\n  --kind MicrosoftThreatIntelligence \\\n  --microsoft-threat-intelligence '{\n    \"dataTypes\": {\"microsoftEmergingThreatFeed\": {\"lookbackPeriod\": \"2025-01-01T00:00:00Z\", \"state\": \"Enabled\"}}\n  }'\n```\n\n```kql\n\u002F\u002F Match network indicators against cloud flow logs\nlet TI_IPs = ThreatIntelligenceIndicator\n| where TimeGenerated > ago(30d)\n| where isnotempty(NetworkIP)\n| distinct NetworkIP;\nAzureNetworkAnalytics_CL\n| where TimeGenerated > ago(24h)\n| where DestIP_s in (TI_IPs)\n| project TimeGenerated, SrcIP_s, DestIP_s, DestPort_d, FlowType_s\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| KQL | Kusto Query Language, the primary query language for Microsoft Sentinel used to search, analyze, and visualize security data |\n| Analytics Rule | Detection logic in Sentinel that evaluates log data on a schedule and creates incidents when conditions match |\n| SOAR Playbook | Automated workflow triggered by incidents that performs response actions such as blocking accounts, enriching alerts, or notifying teams |\n| Data Connector | Integration module that ingests security logs from cloud services, identity providers, and third-party tools into Sentinel |\n| Sentinel Data Lake | Petabyte-scale storage layer providing long-term log retention with KQL and SQL query interfaces for advanced hunting |\n| Workbook | Interactive dashboard in Sentinel displaying visualizations of security data, trends, and operational metrics |\n| Watchlist | Reference data tables in Sentinel used to enrich alerts with context such as VIP user lists or approved IP ranges |\n| Fusion Detection | Machine learning-powered correlation engine that automatically detects multi-stage attacks across data sources |\n\n## Tools & Systems\n\n- **Microsoft Sentinel**: Cloud-native SIEM\u002FSOAR platform built on Azure Log Analytics with AI-powered threat detection\n- **Azure Logic Apps**: Low-code automation platform for building SOAR playbooks triggered by Sentinel incidents\n- **Microsoft Threat Intelligence**: Integrated threat feeds providing IP, domain, and URL indicators for matching against security logs\n- **Azure Data Explorer**: High-performance analytics engine underlying Sentinel KQL queries for large-scale data exploration\n- **MITRE ATT&CK Navigator**: Framework for mapping Sentinel detection rules to adversary tactics and techniques\n\n## Common Scenarios\n\n### Scenario: Detecting Cross-Cloud Credential Theft Campaign\n\n**Context**: An attacker compromises an Azure AD account through phishing, then uses the account to access AWS resources via federated identity. Sentinel needs to correlate the Azure sign-in anomaly with unusual AWS API activity.\n\n**Approach**:\n1. Create an analytics rule detecting Azure AD impossible travel or anomalous sign-in risk\n2. Write a KQL query correlating the compromised Azure AD identity with AWS CloudTrail AssumeRoleWithSAML events\n3. Build a Fusion detection rule that links Azure AD risk events with subsequent AWS privilege escalation activity\n4. Deploy a SOAR playbook that automatically disables the Azure AD account and revokes AWS STS sessions\n5. Create a workbook showing the timeline from initial compromise through lateral movement to AWS\n6. Run a hunting query across the data lake to check for similar patterns affecting other accounts\n\n**Pitfalls**: Not correlating identity across cloud providers misses the full attack chain. Setting analytics rule frequency too low (e.g., 24 hours) allows attackers hours of undetected access.\n\n## Output Format\n\n```\nMicrosoft Sentinel SOC Operations Report\n==========================================\nWorkspace: sentinel-workspace\nData Sources: 14 connectors active\nReport Period: 2025-02-01 to 2025-02-23\n\nDATA INGESTION:\n  Azure AD Sign-in Logs:     2.3 TB (23 days)\n  AWS CloudTrail:            1.8 TB (23 days)\n  Azure Activity:            0.9 TB (23 days)\n  Defender for Cloud Alerts: 45 GB (23 days)\n  Total Ingestion:           5.1 TB\n\nDETECTION SUMMARY:\n  Active Analytics Rules: 87\n  Incidents Created: 234\n    Critical: 8 | High: 34 | Medium: 89 | Low: 103\n  Mean Time to Detect (MTTD): 4.2 minutes\n  Mean Time to Respond (MTTR): 18 minutes\n\nTOP INCIDENT TYPES:\n  Impossible Travel Detected:          42 incidents\n  AWS Unauthorized API Call Pattern:   28 incidents\n  Mass File Deletion in S3:            3 incidents\n  Suspicious Azure AD App Registration: 12 incidents\n\nAUTOMATION:\n  Playbooks Executed: 156\n  Accounts Auto-Disabled: 23\n  Incidents Auto-Enriched: 198\n  False Positive Rate: 12%\n```\n",{"name":5,"tags":49,"author":50,"domain":28,"license":15,"version":51,"nist_csf":52,"subdomain":27,"description":7,"nist_ai_rmf":57,"mitre_attack":61,"atlas_techniques":67},[32,31,30,29,34],"mahipal","1.0.0",[53,54,55,56],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01",[58,59,60],"MEASURE-2.7","MAP-5.1","MANAGE-2.4",[62,63,64,65,66],"T1078.004","T1548.005","T1485","T1530","T1021.007",[68,69,70],"AML.T0070","AML.T0066","AML.T0082","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fbuilding-cloud-siem-with-sentinel",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":82,"prompt":92,"zipAvailable":93},[83,86,89],{"tool":84,"command":85},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-cloud-siem-with-sentinel",{"tool":87,"command":88},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-cloud-siem-with-sentinel",{"tool":90,"command":91},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-cloud-siem-with-sentinel","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-cloud-siem-with-sentinel\u002FSKILL.md",true,[95,100,106],{"path":96,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-cloud-siem-with-sentinel\u002FLICENSE",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md","REFERENCE","参考文档",1903,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-cloud-siem-with-sentinel\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"scripts\u002Fagent.py","SCRIPT","脚本",6860,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-cloud-siem-with-sentinel\u002Fscripts\u002Fagent.py",[113,139,163,191,217,244],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":120,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[119],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[121,122,123,124,125,28,126,127,38,128,129,130,131,132,133,134,135,136,137,138],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":146,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[145],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[147,135,148,149,125,150,28,38,151,152,153,154,155,156,157,158,159,160,161,162],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":173,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[169,172],{"categoryNo":170,"categoryName":171,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[157,174,175,176,177,28,178,179,151,180,181,182,183,184,185,186,187,188,189,190],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":192,"name":193,"nameZh":6,"description":194,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":195,"categories":196,"keywords":198,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[197],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[199,200,201,28,202,203,204,205,206,207,208,209,210,211,212,213,154,214,215,216],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":218,"name":219,"nameZh":6,"description":220,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":221,"categories":222,"keywords":224,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[223],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[225,226,227,28,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":245,"name":246,"nameZh":6,"description":247,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":248,"categories":249,"keywords":251,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[250],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[125,252,28,26,253,254,35,255,256,257,258,186,259,187,260,261,262,263,264,265],"triaging security incident","file","ioc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]