[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HCGKB6B6HD76NNV0NF8KME":3,"skill-same:01M6HCGKB6B6HD76NNV0NF8KME":111},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":72,"commitSha":73,"skillDirectory":74,"forksCount":75,"repositoryHtmlUrl":76,"repositoryHomepageUrl":6,"ownerHtmlUrl":77,"ownerBlogUrl":6,"ownerDescription":78,"updatedAt":79,"install":80,"resources":93},"01M6HCGKB6B6HD76NNV0NF8KME","building-cloud-siem-with-sentinel",null,"This skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations. It details configuring data connectors for multi-cloud log ingestion, writing KQL detection queries, building automated...","HenriqueMC17\u002Fagente-core","HenriqueMC17","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F206460478?v=4","01M6HB63HBBF18AC4H09XTB549","Henrique Monteiro Cardoso","01M6HB63NGSQXWKWCFWW2B20W0",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fbuilding-cloud-siem-with-sentinel\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"with","siem","cloud","sentinel","building cloud siem with sentinel","soar-automation","map","log","cm","ingestion","aml","t1078","writing","kql-queries","cloud-siem","microsoft-sentinel","threat-detection","soar","security operations","cybersecurity","2026-11-10 10:12:30",false,"---\nname: building-cloud-siem-with-sentinel\ndescription: This skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations. It details configuring data connectors for multi-cloud log ingestion, writing KQL detection queries, building automated...\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- microsoft-sentinel\n- cloud-siem\n- kql-queries\n- soar-automation\n- threat-detection\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\natlas_techniques:\n- AML.T0070\n- AML.T0066\n- AML.T0082\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1078.004\n- T1548.005\n- T1485\n- T1530\n- T1021.007\ncategory: building-cloud-siem-with-sentinel\n---\n# Building-Cloud-Siem-With-Sentinel\n\n## Overview\nThis skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations. It details configuring data connectors for multi-cloud log ingestion, writing KQL detection queries, building automated response playbooks with Logic Apps, and leveraging the Sentinel data lake for petabyte-scale threat hunting across AWS, Azure, and GCP security telemetry.\n\n\n\n# Building Cloud SIEM with Sentinel\n\n## When to Use\n\n- When establishing a centralized security operations center for multi-cloud environments\n- When migrating from legacy SIEM platforms (Splunk, QRadar) to cloud-native architecture\n- When building automated incident response workflows for cloud-specific threats\n- When performing large-scale threat hunting across petabytes of security telemetry\n- When integrating threat intelligence feeds with cloud security log analysis\n\n**Do not use** for AWS-only environments where Security Hub and GuardDuty suffice, for endpoint detection requiring EDR capabilities (use Defender for Endpoint), or for compliance posture monitoring (see building-cloud-security-posture-management).\n\n## Prerequisites\n\n- Azure subscription with Microsoft Sentinel enabled on a Log Analytics workspace\n- Data connector permissions for target log sources (AWS CloudTrail, Azure Activity, GCP)\n- Logic Apps or Azure Functions for automated response playbooks\n- KQL (Kusto Query Language) proficiency for writing detection rules and hunting queries\n\n## Workflow\n\n### Step 1: Provision Sentinel Workspace and Data Connectors\n\nCreate a Log Analytics workspace optimized for security data and enable data connectors for multi-cloud ingestion.\n\n```powershell\n# Create Log Analytics workspace\naz monitor log-analytics workspace create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --location eastus \\\n  --retention-time 365 \\\n  --sku PerGB2018\n\n# Enable Microsoft Sentinel on the workspace\naz sentinel onboarding-state create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace\n\n# Enable AWS CloudTrail connector\naz sentinel data-connector create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --data-connector-id aws-cloudtrail \\\n  --kind AmazonWebServicesCloudTrail \\\n  --aws-cloud-trail-data-connector '{\n    \"awsRoleArn\": \"arn:aws:iam::123456789012:role\u002FSentinelCloudTrailRole\",\n    \"dataTypes\": {\"logs\": {\"state\": \"Enabled\"}}\n  }'\n\n# Enable Azure AD sign-in and audit logs\naz sentinel data-connector create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --data-connector-id azure-ad \\\n  --kind AzureActiveDirectory \\\n  --azure-active-directory '{\n    \"dataTypes\": {\n      \"alerts\": {\"state\": \"Enabled\"},\n      \"signinLogs\": {\"state\": \"Enabled\"},\n      \"auditLogs\": {\"state\": \"Enabled\"}\n    }\n  }'\n```\n\n### Step 2: Write KQL Detection Rules\n\nCreate analytics rules using Kusto Query Language to detect cloud-specific threats. Map each rule to MITRE ATT&CK techniques.\n\n```kql\n\u002F\u002F Detect impossible travel - sign-ins from geographically distant locations\nlet timeframe = 1h;\nlet distance_threshold = 500; \u002F\u002F km\nSigninLogs\n| where TimeGenerated > ago(timeframe)\n| where ResultType == 0 \u002F\u002F Successful sign-ins only\n| project TimeGenerated, UserPrincipalName, IPAddress, Location,\n          Latitude = toreal(LocationDetails.geoCoordinates.latitude),\n          Longitude = toreal(LocationDetails.geoCoordinates.longitude)\n| sort by UserPrincipalName asc, TimeGenerated asc\n| extend PrevLatitude = prev(Latitude, 1), PrevLongitude = prev(Longitude, 1),\n         PrevTime = prev(TimeGenerated, 1), PrevUser = prev(UserPrincipalName, 1)\n| where UserPrincipalName == PrevUser\n| extend TimeDiff = datetime_diff('minute', TimeGenerated, PrevTime)\n| where TimeDiff \u003C 60\n| extend Distance = geo_distance_2points(Longitude, Latitude, PrevLongitude, PrevLatitude) \u002F 1000\n| where Distance > distance_threshold\n| project TimeGenerated, UserPrincipalName, IPAddress, Location, Distance, TimeDiff\n```\n\n```kql\n\u002F\u002F Detect AWS IAM credential abuse from CloudTrail\nAWSCloudTrail\n| where TimeGenerated > ago(24h)\n| where EventName in (\"ConsoleLogin\", \"AssumeRole\", \"GetSessionToken\")\n| where ErrorCode == \"\"\n| summarize LoginCount = count(), DistinctIPs = dcount(SourceIpAddress),\n            IPList = make_set(SourceIpAddress, 10)\n            by UserIdentityArn, bin(TimeGenerated, 1h)\n| where DistinctIPs > 3\n| project TimeGenerated, UserIdentityArn, LoginCount, DistinctIPs, IPList\n```\n\n```kql\n\u002F\u002F Detect mass S3 object deletion (potential ransomware)\nAWSCloudTrail\n| where TimeGenerated > ago(1h)\n| where EventName == \"DeleteObject\" or EventName == \"DeleteObjects\"\n| summarize DeleteCount = count(), BucketsAffected = dcount(RequestParameters_bucketName)\n            by UserIdentityArn, bin(TimeGenerated, 10m)\n| where DeleteCount > 100\n| project TimeGenerated, UserIdentityArn, DeleteCount, BucketsAffected\n```\n\n### Step 3: Build SOAR Playbooks with Logic Apps\n\nCreate automated response playbooks that execute when analytics rules trigger incidents. Common actions include blocking users, isolating resources, and enriching alerts with threat intelligence.\n\n```json\n{\n  \"definition\": {\n    \"triggers\": {\n      \"Microsoft_Sentinel_incident\": {\n        \"type\": \"ApiConnectionWebhook\",\n        \"inputs\": {\n          \"body\": {\"incidentArmId\": \"subscriptions\u002F@{triggerBody()?['workspaceInfo']?['SubscriptionId']}\u002FresourceGroups\u002F@{triggerBody()?['workspaceInfo']?['ResourceGroupName']}\u002Fproviders\u002FMicrosoft.OperationalInsights\u002Fworkspaces\u002F@{triggerBody()?['workspaceInfo']?['WorkspaceName']}\u002Fproviders\u002FMicrosoft.SecurityInsights\u002FIncidents\u002F@{triggerBody()?['object']?['properties']?['incidentNumber']}\"},\n          \"host\": {\"connection\": {\"name\": \"@parameters('$connections')['microsoftsentinel']['connectionId']\"}}\n        }\n      }\n    },\n    \"actions\": {\n      \"Get_incident_entities\": {\n        \"type\": \"ApiConnection\",\n        \"inputs\": {\"method\": \"post\", \"path\": \"\u002FIncidents\u002Fentities\"}\n      },\n      \"For_each_account_entity\": {\n        \"type\": \"Foreach\",\n        \"foreach\": \"@body('Get_incident_entities')?['Accounts']\",\n        \"actions\": {\n          \"Disable_Azure_AD_user\": {\n            \"type\": \"ApiConnection\",\n            \"inputs\": {\n              \"method\": \"PATCH\",\n              \"path\": \"\u002Fv1.0\u002Fusers\u002F@{items('For_each_account_entity')?['AadUserId']}\",\n              \"body\": {\"accountEnabled\": false}\n            }\n          },\n          \"Add_comment_to_incident\": {\n            \"type\": \"ApiConnection\",\n            \"inputs\": {\n              \"body\": {\"message\": \"User @{items('For_each_account_entity')?['Name']} disabled by automated playbook\"}\n            }\n          }\n        }\n      }\n    }\n  }\n}\n```\n\n### Step 4: Configure Sentinel Data Lake for Long-Term Hunting\n\nEnable the Sentinel data lake for petabyte-scale log retention and advanced threat hunting using both KQL and SQL endpoints.\n\n```kql\n\u002F\u002F Threat hunting query: detect lateral movement across AWS accounts\nlet suspicious_roles = AWSCloudTrail\n| where TimeGenerated > ago(7d)\n| where EventName == \"AssumeRole\"\n| extend AssumedRoleArn = tostring(parse_json(RequestParameters).roleArn)\n| where AssumedRoleArn contains \"cross-account\" or AssumedRoleArn contains \"admin\"\n| summarize AssumeCount = count(), UniqueSourceAccounts = dcount(RecipientAccountId)\n            by UserIdentityArn, AssumedRoleArn\n| where AssumeCount > 10 and UniqueSourceAccounts > 2;\nsuspicious_roles\n| join kind=inner (\n    AWSCloudTrail\n    | where TimeGenerated > ago(7d)\n    | where EventName in (\"RunInstances\", \"CreateFunction\", \"PutBucketPolicy\")\n) on UserIdentityArn\n| project TimeGenerated, UserIdentityArn, AssumedRoleArn, EventName, SourceIpAddress\n```\n\n### Step 5: Integrate Threat Intelligence\n\nConnect threat intelligence providers and create indicator-based matching rules to detect communication with known malicious infrastructure.\n\n```powershell\n# Enable Microsoft Threat Intelligence connector\naz sentinel data-connector create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --data-connector-id microsoft-ti \\\n  --kind MicrosoftThreatIntelligence \\\n  --microsoft-threat-intelligence '{\n    \"dataTypes\": {\"microsoftEmergingThreatFeed\": {\"lookbackPeriod\": \"2025-01-01T00:00:00Z\", \"state\": \"Enabled\"}}\n  }'\n```\n\n```kql\n\u002F\u002F Match network indicators against cloud flow logs\nlet TI_IPs = ThreatIntelligenceIndicator\n| where TimeGenerated > ago(30d)\n| where isnotempty(NetworkIP)\n| distinct NetworkIP;\nAzureNetworkAnalytics_CL\n| where TimeGenerated > ago(24h)\n| where DestIP_s in (TI_IPs)\n| project TimeGenerated, SrcIP_s, DestIP_s, DestPort_d, FlowType_s\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| KQL | Kusto Query Language, the primary query language for Microsoft Sentinel used to search, analyze, and visualize security data |\n| Analytics Rule | Detection logic in Sentinel that evaluates log data on a schedule and creates incidents when conditions match |\n| SOAR Playbook | Automated workflow triggered by incidents that performs response actions such as blocking accounts, enriching alerts, or notifying teams |\n| Data Connector | Integration module that ingests security logs from cloud services, identity providers, and third-party tools into Sentinel |\n| Sentinel Data Lake | Petabyte-scale storage layer providing long-term log retention with KQL and SQL query interfaces for advanced hunting |\n| Workbook | Interactive dashboard in Sentinel displaying visualizations of security data, trends, and operational metrics |\n| Watchlist | Reference data tables in Sentinel used to enrich alerts with context such as VIP user lists or approved IP ranges |\n| Fusion Detection | Machine learning-powered correlation engine that automatically detects multi-stage attacks across data sources |\n\n## Tools & Systems\n\n- **Microsoft Sentinel**: Cloud-native SIEM\u002FSOAR platform built on Azure Log Analytics with AI-powered threat detection\n- **Azure Logic Apps**: Low-code automation platform for building SOAR playbooks triggered by Sentinel incidents\n- **Microsoft Threat Intelligence**: Integrated threat feeds providing IP, domain, and URL indicators for matching against security logs\n- **Azure Data Explorer**: High-performance analytics engine underlying Sentinel KQL queries for large-scale data exploration\n- **MITRE ATT&CK Navigator**: Framework for mapping Sentinel detection rules to adversary tactics and techniques\n\n## Common Scenarios\n\n### Scenario: Detecting Cross-Cloud Credential Theft Campaign\n\n**Context**: An attacker compromises an Azure AD account through phishing, then uses the account to access AWS resources via federated identity. Sentinel needs to correlate the Azure sign-in anomaly with unusual AWS API activity.\n\n**Approach**:\n1. Create an analytics rule detecting Azure AD impossible travel or anomalous sign-in risk\n2. Write a KQL query correlating the compromised Azure AD identity with AWS CloudTrail AssumeRoleWithSAML events\n3. Build a Fusion detection rule that links Azure AD risk events with subsequent AWS privilege escalation activity\n4. Deploy a SOAR playbook that automatically disables the Azure AD account and revokes AWS STS sessions\n5. Create a workbook showing the timeline from initial compromise through lateral movement to AWS\n6. Run a hunting query across the data lake to check for similar patterns affecting other accounts\n\n**Pitfalls**: Not correlating identity across cloud providers misses the full attack chain. Setting analytics rule frequency too low (e.g., 24 hours) allows attackers hours of undetected access.\n\n## Output Format\n\n```\nMicrosoft Sentinel SOC Operations Report\n==========================================\nWorkspace: sentinel-workspace\nData Sources: 14 connectors active\nReport Period: 2025-02-01 to 2025-02-23\n\nDATA INGESTION:\n  Azure AD Sign-in Logs:     2.3 TB (23 days)\n  AWS CloudTrail:            1.8 TB (23 days)\n  Azure Activity:            0.9 TB (23 days)\n  Defender for Cloud Alerts: 45 GB (23 days)\n  Total Ingestion:           5.1 TB\n\nDETECTION SUMMARY:\n  Active Analytics Rules: 87\n  Incidents Created: 234\n    Critical: 8 | High: 34 | Medium: 89 | Low: 103\n  Mean Time to Detect (MTTD): 4.2 minutes\n  Mean Time to Respond (MTTR): 18 minutes\n\nTOP INCIDENT TYPES:\n  Impossible Travel Detected:          42 incidents\n  AWS Unauthorized API Call Pattern:   28 incidents\n  Mass File Deletion in S3:            3 incidents\n  Suspicious Azure AD App Registration: 12 incidents\n\nAUTOMATION:\n  Playbooks Executed: 156\n  Accounts Auto-Disabled: 23\n  Incidents Auto-Enriched: 198\n  False Positive Rate: 12%\n```\n","# Building-Cloud-Siem-With-Sentinel\n\n## Overview\nThis skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations. It details configuring data connectors for multi-cloud log ingestion, writing KQL detection queries, building automated response playbooks with Logic Apps, and leveraging the Sentinel data lake for petabyte-scale threat hunting across AWS, Azure, and GCP security telemetry.\n\n\n\n# Building Cloud SIEM with Sentinel\n\n## When to Use\n\n- When establishing a centralized security operations center for multi-cloud environments\n- When migrating from legacy SIEM platforms (Splunk, QRadar) to cloud-native architecture\n- When building automated incident response workflows for cloud-specific threats\n- When performing large-scale threat hunting across petabytes of security telemetry\n- When integrating threat intelligence feeds with cloud security log analysis\n\n**Do not use** for AWS-only environments where Security Hub and GuardDuty suffice, for endpoint detection requiring EDR capabilities (use Defender for Endpoint), or for compliance posture monitoring (see building-cloud-security-posture-management).\n\n## Prerequisites\n\n- Azure subscription with Microsoft Sentinel enabled on a Log Analytics workspace\n- Data connector permissions for target log sources (AWS CloudTrail, Azure Activity, GCP)\n- Logic Apps or Azure Functions for automated response playbooks\n- KQL (Kusto Query Language) proficiency for writing detection rules and hunting queries\n\n## Workflow\n\n### Step 1: Provision Sentinel Workspace and Data Connectors\n\nCreate a Log Analytics workspace optimized for security data and enable data connectors for multi-cloud ingestion.\n\n```powershell\n# Create Log Analytics workspace\naz monitor log-analytics workspace create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --location eastus \\\n  --retention-time 365 \\\n  --sku PerGB2018\n\n# Enable Microsoft Sentinel on the workspace\naz sentinel onboarding-state create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace\n\n# Enable AWS CloudTrail connector\naz sentinel data-connector create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --data-connector-id aws-cloudtrail \\\n  --kind AmazonWebServicesCloudTrail \\\n  --aws-cloud-trail-data-connector '{\n    \"awsRoleArn\": \"arn:aws:iam::123456789012:role\u002FSentinelCloudTrailRole\",\n    \"dataTypes\": {\"logs\": {\"state\": \"Enabled\"}}\n  }'\n\n# Enable Azure AD sign-in and audit logs\naz sentinel data-connector create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --data-connector-id azure-ad \\\n  --kind AzureActiveDirectory \\\n  --azure-active-directory '{\n    \"dataTypes\": {\n      \"alerts\": {\"state\": \"Enabled\"},\n      \"signinLogs\": {\"state\": \"Enabled\"},\n      \"auditLogs\": {\"state\": \"Enabled\"}\n    }\n  }'\n```\n\n### Step 2: Write KQL Detection Rules\n\nCreate analytics rules using Kusto Query Language to detect cloud-specific threats. Map each rule to MITRE ATT&CK techniques.\n\n```kql\n\u002F\u002F Detect impossible travel - sign-ins from geographically distant locations\nlet timeframe = 1h;\nlet distance_threshold = 500; \u002F\u002F km\nSigninLogs\n| where TimeGenerated > ago(timeframe)\n| where ResultType == 0 \u002F\u002F Successful sign-ins only\n| project TimeGenerated, UserPrincipalName, IPAddress, Location,\n          Latitude = toreal(LocationDetails.geoCoordinates.latitude),\n          Longitude = toreal(LocationDetails.geoCoordinates.longitude)\n| sort by UserPrincipalName asc, TimeGenerated asc\n| extend PrevLatitude = prev(Latitude, 1), PrevLongitude = prev(Longitude, 1),\n         PrevTime = prev(TimeGenerated, 1), PrevUser = prev(UserPrincipalName, 1)\n| where UserPrincipalName == PrevUser\n| extend TimeDiff = datetime_diff('minute', TimeGenerated, PrevTime)\n| where TimeDiff \u003C 60\n| extend Distance = geo_distance_2points(Longitude, Latitude, PrevLongitude, PrevLatitude) \u002F 1000\n| where Distance > distance_threshold\n| project TimeGenerated, UserPrincipalName, IPAddress, Location, Distance, TimeDiff\n```\n\n```kql\n\u002F\u002F Detect AWS IAM credential abuse from CloudTrail\nAWSCloudTrail\n| where TimeGenerated > ago(24h)\n| where EventName in (\"ConsoleLogin\", \"AssumeRole\", \"GetSessionToken\")\n| where ErrorCode == \"\"\n| summarize LoginCount = count(), DistinctIPs = dcount(SourceIpAddress),\n            IPList = make_set(SourceIpAddress, 10)\n            by UserIdentityArn, bin(TimeGenerated, 1h)\n| where DistinctIPs > 3\n| project TimeGenerated, UserIdentityArn, LoginCount, DistinctIPs, IPList\n```\n\n```kql\n\u002F\u002F Detect mass S3 object deletion (potential ransomware)\nAWSCloudTrail\n| where TimeGenerated > ago(1h)\n| where EventName == \"DeleteObject\" or EventName == \"DeleteObjects\"\n| summarize DeleteCount = count(), BucketsAffected = dcount(RequestParameters_bucketName)\n            by UserIdentityArn, bin(TimeGenerated, 10m)\n| where DeleteCount > 100\n| project TimeGenerated, UserIdentityArn, DeleteCount, BucketsAffected\n```\n\n### Step 3: Build SOAR Playbooks with Logic Apps\n\nCreate automated response playbooks that execute when analytics rules trigger incidents. Common actions include blocking users, isolating resources, and enriching alerts with threat intelligence.\n\n```json\n{\n  \"definition\": {\n    \"triggers\": {\n      \"Microsoft_Sentinel_incident\": {\n        \"type\": \"ApiConnectionWebhook\",\n        \"inputs\": {\n          \"body\": {\"incidentArmId\": \"subscriptions\u002F@{triggerBody()?['workspaceInfo']?['SubscriptionId']}\u002FresourceGroups\u002F@{triggerBody()?['workspaceInfo']?['ResourceGroupName']}\u002Fproviders\u002FMicrosoft.OperationalInsights\u002Fworkspaces\u002F@{triggerBody()?['workspaceInfo']?['WorkspaceName']}\u002Fproviders\u002FMicrosoft.SecurityInsights\u002FIncidents\u002F@{triggerBody()?['object']?['properties']?['incidentNumber']}\"},\n          \"host\": {\"connection\": {\"name\": \"@parameters('$connections')['microsoftsentinel']['connectionId']\"}}\n        }\n      }\n    },\n    \"actions\": {\n      \"Get_incident_entities\": {\n        \"type\": \"ApiConnection\",\n        \"inputs\": {\"method\": \"post\", \"path\": \"\u002FIncidents\u002Fentities\"}\n      },\n      \"For_each_account_entity\": {\n        \"type\": \"Foreach\",\n        \"foreach\": \"@body('Get_incident_entities')?['Accounts']\",\n        \"actions\": {\n          \"Disable_Azure_AD_user\": {\n            \"type\": \"ApiConnection\",\n            \"inputs\": {\n              \"method\": \"PATCH\",\n              \"path\": \"\u002Fv1.0\u002Fusers\u002F@{items('For_each_account_entity')?['AadUserId']}\",\n              \"body\": {\"accountEnabled\": false}\n            }\n          },\n          \"Add_comment_to_incident\": {\n            \"type\": \"ApiConnection\",\n            \"inputs\": {\n              \"body\": {\"message\": \"User @{items('For_each_account_entity')?['Name']} disabled by automated playbook\"}\n            }\n          }\n        }\n      }\n    }\n  }\n}\n```\n\n### Step 4: Configure Sentinel Data Lake for Long-Term Hunting\n\nEnable the Sentinel data lake for petabyte-scale log retention and advanced threat hunting using both KQL and SQL endpoints.\n\n```kql\n\u002F\u002F Threat hunting query: detect lateral movement across AWS accounts\nlet suspicious_roles = AWSCloudTrail\n| where TimeGenerated > ago(7d)\n| where EventName == \"AssumeRole\"\n| extend AssumedRoleArn = tostring(parse_json(RequestParameters).roleArn)\n| where AssumedRoleArn contains \"cross-account\" or AssumedRoleArn contains \"admin\"\n| summarize AssumeCount = count(), UniqueSourceAccounts = dcount(RecipientAccountId)\n            by UserIdentityArn, AssumedRoleArn\n| where AssumeCount > 10 and UniqueSourceAccounts > 2;\nsuspicious_roles\n| join kind=inner (\n    AWSCloudTrail\n    | where TimeGenerated > ago(7d)\n    | where EventName in (\"RunInstances\", \"CreateFunction\", \"PutBucketPolicy\")\n) on UserIdentityArn\n| project TimeGenerated, UserIdentityArn, AssumedRoleArn, EventName, SourceIpAddress\n```\n\n### Step 5: Integrate Threat Intelligence\n\nConnect threat intelligence providers and create indicator-based matching rules to detect communication with known malicious infrastructure.\n\n```powershell\n# Enable Microsoft Threat Intelligence connector\naz sentinel data-connector create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --data-connector-id microsoft-ti \\\n  --kind MicrosoftThreatIntelligence \\\n  --microsoft-threat-intelligence '{\n    \"dataTypes\": {\"microsoftEmergingThreatFeed\": {\"lookbackPeriod\": \"2025-01-01T00:00:00Z\", \"state\": \"Enabled\"}}\n  }'\n```\n\n```kql\n\u002F\u002F Match network indicators against cloud flow logs\nlet TI_IPs = ThreatIntelligenceIndicator\n| where TimeGenerated > ago(30d)\n| where isnotempty(NetworkIP)\n| distinct NetworkIP;\nAzureNetworkAnalytics_CL\n| where TimeGenerated > ago(24h)\n| where DestIP_s in (TI_IPs)\n| project TimeGenerated, SrcIP_s, DestIP_s, DestPort_d, FlowType_s\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| KQL | Kusto Query Language, the primary query language for Microsoft Sentinel used to search, analyze, and visualize security data |\n| Analytics Rule | Detection logic in Sentinel that evaluates log data on a schedule and creates incidents when conditions match |\n| SOAR Playbook | Automated workflow triggered by incidents that performs response actions such as blocking accounts, enriching alerts, or notifying teams |\n| Data Connector | Integration module that ingests security logs from cloud services, identity providers, and third-party tools into Sentinel |\n| Sentinel Data Lake | Petabyte-scale storage layer providing long-term log retention with KQL and SQL query interfaces for advanced hunting |\n| Workbook | Interactive dashboard in Sentinel displaying visualizations of security data, trends, and operational metrics |\n| Watchlist | Reference data tables in Sentinel used to enrich alerts with context such as VIP user lists or approved IP ranges |\n| Fusion Detection | Machine learning-powered correlation engine that automatically detects multi-stage attacks across data sources |\n\n## Tools & Systems\n\n- **Microsoft Sentinel**: Cloud-native SIEM\u002FSOAR platform built on Azure Log Analytics with AI-powered threat detection\n- **Azure Logic Apps**: Low-code automation platform for building SOAR playbooks triggered by Sentinel incidents\n- **Microsoft Threat Intelligence**: Integrated threat feeds providing IP, domain, and URL indicators for matching against security logs\n- **Azure Data Explorer**: High-performance analytics engine underlying Sentinel KQL queries for large-scale data exploration\n- **MITRE ATT&CK Navigator**: Framework for mapping Sentinel detection rules to adversary tactics and techniques\n\n## Common Scenarios\n\n### Scenario: Detecting Cross-Cloud Credential Theft Campaign\n\n**Context**: An attacker compromises an Azure AD account through phishing, then uses the account to access AWS resources via federated identity. Sentinel needs to correlate the Azure sign-in anomaly with unusual AWS API activity.\n\n**Approach**:\n1. Create an analytics rule detecting Azure AD impossible travel or anomalous sign-in risk\n2. Write a KQL query correlating the compromised Azure AD identity with AWS CloudTrail AssumeRoleWithSAML events\n3. Build a Fusion detection rule that links Azure AD risk events with subsequent AWS privilege escalation activity\n4. Deploy a SOAR playbook that automatically disables the Azure AD account and revokes AWS STS sessions\n5. Create a workbook showing the timeline from initial compromise through lateral movement to AWS\n6. Run a hunting query across the data lake to check for similar patterns affecting other accounts\n\n**Pitfalls**: Not correlating identity across cloud providers misses the full attack chain. Setting analytics rule frequency too low (e.g., 24 hours) allows attackers hours of undetected access.\n\n## Output Format\n\n```\nMicrosoft Sentinel SOC Operations Report\n==========================================\nWorkspace: sentinel-workspace\nData Sources: 14 connectors active\nReport Period: 2025-02-01 to 2025-02-23\n\nDATA INGESTION:\n  Azure AD Sign-in Logs:     2.3 TB (23 days)\n  AWS CloudTrail:            1.8 TB (23 days)\n  Azure Activity:            0.9 TB (23 days)\n  Defender for Cloud Alerts: 45 GB (23 days)\n  Total Ingestion:           5.1 TB\n\nDETECTION SUMMARY:\n  Active Analytics Rules: 87\n  Incidents Created: 234\n    Critical: 8 | High: 34 | Medium: 89 | Low: 103\n  Mean Time to Detect (MTTD): 4.2 minutes\n  Mean Time to Respond (MTTR): 18 minutes\n\nTOP INCIDENT TYPES:\n  Impossible Travel Detected:          42 incidents\n  AWS Unauthorized API Call Pattern:   28 incidents\n  Mass File Deletion in S3:            3 incidents\n  Suspicious Azure AD App Registration: 12 incidents\n\nAUTOMATION:\n  Playbooks Executed: 156\n  Accounts Auto-Disabled: 23\n  Incidents Auto-Enriched: 198\n  False Positive Rate: 12%\n```\n",{"name":5,"tags":49,"author":50,"domain":43,"license":15,"version":51,"category":5,"nist_csf":52,"subdomain":57,"description":7,"nist_ai_rmf":58,"mitre_attack":62,"atlas_techniques":68},[39,38,37,29,40],"mahipal","1.0.0",[53,54,55,56],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01","cloud-security",[59,60,61],"MEASURE-2.7","MAP-5.1","MANAGE-2.4",[63,64,65,66,67],"T1078.004","T1548.005","T1485","T1530","T1021.007",[69,70,71],"AML.T0070","AML.T0066","AML.T0082","main","5eea5b3296f4673b5f481e8bcc1ba76281149f16","modules\u002Fbuilding-cloud-siem-with-sentinel",0,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core","https:\u002F\u002Fgithub.com\u002FHenriqueMC17","Qualquer tecnologia suficientemente avançada é indistinguível da mágica.","2026-09-28 22:40:38",{"source":8,"skillName":5,"commands":81,"prompt":91,"zipAvailable":92},[82,85,88],{"tool":83,"command":84},"npx","npx skills add HenriqueMC17\u002Fagente-core --skill building-cloud-siem-with-sentinel",{"tool":86,"command":87},"bunx","bunx skills add HenriqueMC17\u002Fagente-core --skill building-cloud-siem-with-sentinel",{"tool":89,"command":90},"pnpm","pnpm dlx skills add HenriqueMC17\u002Fagente-core --skill building-cloud-siem-with-sentinel","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fbuilding-cloud-siem-with-sentinel\u002FSKILL.md",true,[94,99,105],{"path":95,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fbuilding-cloud-siem-with-sentinel\u002FLICENSE",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fapi-reference.md","REFERENCE","参考文档",1903,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fbuilding-cloud-siem-with-sentinel\u002Freferences\u002Fapi-reference.md",{"path":106,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":109,"sourceHtmlUrl":110},"scripts\u002Fagent.py","SCRIPT","脚本",6860,"https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fbuilding-cloud-siem-with-sentinel\u002Fscripts\u002Fagent.py",[112,140,165,188,204,223],{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":121,"publishedAt":44},"01M6HPFF0RCN0X6WT5EBSV71GY","validating-backup-integrity-for-recovery","Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[118],{"categoryNo":119,"categoryName":120,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",[122,123,124,125,126,127,43,128,129,130,131,132,133,35,134,135,136,137,138,139],"integrity","backup","recovery","validating backup integrity for recovery","for","testing","validate","verification","hash-verification","incident-response","ransomware","detection","t1490","disaster-recovery","restore","incident","disaster recovery","ransomware response",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":146,"publishedAt":44},"01M6HPFAWJVFK25Q33K3T7WQ8G","triaging-vulnerabilities-with-ssvc-framework","Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[],[147,148,149,150,24,43,151,152,153,154,155,156,157,158,159,160,161,162,163,164],"vulnerabilities","framework","ssvc","triaging vulnerabilities with ssvc framework","triage and prioritize","CISA","vulnerability-management","risk-management","cvss","remediation","vulnerability","prioritization","decision-tree","prioritize","decision","priorities","actionable","tree",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":171,"publishedAt":44},"01M6HPF6JS9X72WP59094H3ASQ","triaging-security-incident","Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident\u002FSKILL.md",[],[172,173,137,43,174,175,176,35,134,177,178,179,180,181,182,183,184,185,186,187],"security","triaging security incident","actions","soc","NIST","analysis","severity-classification","incident-triage","SANS-PICERL","SOC-operations","picerl","conversion","isolation","scope","impact","consistency",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":194,"publishedAt":44},"01M6HPF2EX6ZYNYYHKBRJN7GEF","triaging-security-incident-with-ir-playbook","Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[172,195,196,173,137,24,43,197,175,131,198,199,35,134,200,178,160,201,202,203],"playbook","triaging security incident with ir playbook","teams","IR-playbook","severity","classification","classify","incidents","initiate",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":210,"publishedAt":44},"01M6HPEY9XPGE7X95AG4XJFQAW","triaging-security-alerts-in-splunk","Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when...","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftriaging-security-alerts-in-splunk\u002FSKILL.md",[],[172,211,212,213,214,215,43,25,216,217,175,218,35,219,220,221,181,32,137,222],"security alerts","splunk","triaging security alerts in splunk","alerts","review","dashboard","search","correlation-search","t1566","notable-events","incident-review","de",{"skillNo":224,"name":225,"nameZh":6,"description":226,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":227,"categories":228,"keywords":229,"publishedAt":44},"01M6HPET6XGEPEJPN7V032JGZ0","tracking-threat-actor-infrastructure","Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a","https:\u002F\u002Fgithub.com\u002FHenriqueMC17\u002Fagente-core\u002Fblob\u002Fmain\u002Fmodules\u002Ftracking-threat-actor-infrastructure\u002FSKILL.md",[],[230,231,232,233,43,234,235,236,237,238,239,219,240,241,32,242,222,243,244,245],"infrastructure","tracking threat actor infrastructure","tracking","threat","monitoring","mitre-attack","threat-actor","threat-intelligence","command-and-control","dns","command","exploit","intelligence","domains","kit","hosts"]