[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CEJM7W8TV0H63PFSYGTX4":3,"skill-same:01M71CEJM7W8TV0H63PFSYGTX4":105},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":78,"commitSha":79,"skillDirectory":80,"forksCount":14,"repositoryHtmlUrl":81,"repositoryHomepageUrl":6,"ownerHtmlUrl":82,"ownerBlogUrl":6,"ownerDescription":83,"updatedAt":84,"install":85,"resources":98},"01M71CEJM7W8TV0H63PFSYGTX4","azure-sentinel-detect",null,"This skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations. It details configuring data connectors for multi-cloud log ingestion, writing KQL detection queries, building automated response playbooks with Logic Apps, and leveraging the Sentinel data lake for petabyte-scale threat hunting across AWS, Azure, and GCP security telemetry.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fazure\u002Fsentinel\u002Fdetect\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"azure sentinel detect","azure sentinel","detect","azure","sentinel","aml","apps","across","map","log","cm","ingestion","writing","Bash","microsoft-sentinel","gcp","soar","siem","security operations","cybersecurity","2026-11-10 10:12:30",false,"---\nname: azure-sentinel-detect\ndescription: This skill covers deploying Microsoft Sentinel as a cloud-native SIEM and SOAR platform for centralized security operations. It details configuring data connectors for multi-cloud log ingestion, writing KQL detection queries, building automated response playbooks with Logic Apps, and leveraging the Sentinel data lake for petabyte-scale threat hunting across AWS, Azure, and GCP security telemetry.\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- microsoft-sentinel\n- cloud-siem\n- kql-queries\n- soar-automation\n- threat-detection\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\natlas_techniques:\n- AML.T0070\n- AML.T0066\n- AML.T0082\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1059\n- T1070\ncapec: []\n---\n\n# Building Cloud SIEM with Sentinel\n\n## When to Use\n\n- When establishing a centralized security operations center for multi-cloud environments\n- When migrating from legacy SIEM platforms (Splunk, QRadar) to cloud-native architecture\n- When building automated incident response workflows for cloud-specific threats\n- When performing large-scale threat hunting across petabytes of security telemetry\n- When integrating threat intelligence feeds with cloud security log analysis\n\n**Do not use** for AWS-only environments where Security Hub and GuardDuty suffice, for endpoint detection requiring EDR capabilities (use Defender for Endpoint), or for compliance posture monitoring (see building-cloud-security-posture-management).\n\n## Prerequisites\n\n- Azure subscription with Microsoft Sentinel enabled on a Log Analytics workspace\n- Data connector permissions for target log sources (AWS CloudTrail, Azure Activity, GCP)\n- Logic Apps or Azure Functions for automated response playbooks\n- KQL (Kusto Query Language) proficiency for writing detection rules and hunting queries\n\n## Workflow\n\n### Step 1: Provision Sentinel Workspace and Data Connectors\n\nCreate a Log Analytics workspace optimized for security data and enable data connectors for multi-cloud ingestion.\n\n```powershell\n# Create Log Analytics workspace\naz monitor log-analytics workspace create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --location eastus \\\n  --retention-time 365 \\\n  --sku PerGB2018\n\n# Enable Microsoft Sentinel on the workspace\naz sentinel onboarding-state create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace\n\n# Enable AWS CloudTrail connector\naz sentinel data-connector create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --data-connector-id aws-cloudtrail \\\n  --kind AmazonWebServicesCloudTrail \\\n  --aws-cloud-trail-data-connector '{\n    \"awsRoleArn\": \"arn:aws:iam::123456789012:role\u002FSentinelCloudTrailRole\",\n    \"dataTypes\": {\"logs\": {\"state\": \"Enabled\"}}\n  }'\n\n# Enable Azure AD sign-in and audit logs\naz sentinel data-connector create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --data-connector-id azure-ad \\\n  --kind AzureActiveDirectory \\\n  --azure-active-directory '{\n    \"dataTypes\": {\n      \"alerts\": {\"state\": \"Enabled\"},\n      \"signinLogs\": {\"state\": \"Enabled\"},\n      \"auditLogs\": {\"state\": \"Enabled\"}\n    }\n  }'\n```\n\n### Step 2: Write KQL Detection Rules\n\nCreate analytics rules using Kusto Query Language to detect cloud-specific threats. Map each rule to MITRE ATT&CK techniques.\n\n```kql\n\u002F\u002F Detect impossible travel - sign-ins from geographically distant locations\nlet timeframe = 1h;\nlet distance_threshold = 500; \u002F\u002F km\nSigninLogs\n| where TimeGenerated > ago(timeframe)\n| where ResultType == 0 \u002F\u002F Successful sign-ins only\n| project TimeGenerated, UserPrincipalName, IPAddress, Location,\n          Latitude = toreal(LocationDetails.geoCoordinates.latitude),\n          Longitude = toreal(LocationDetails.geoCoordinates.longitude)\n| sort by UserPrincipalName asc, TimeGenerated asc\n| extend PrevLatitude = prev(Latitude, 1), PrevLongitude = prev(Longitude, 1),\n         PrevTime = prev(TimeGenerated, 1), PrevUser = prev(UserPrincipalName, 1)\n| where UserPrincipalName == PrevUser\n| extend TimeDiff = datetime_diff('minute', TimeGenerated, PrevTime)\n| where TimeDiff \u003C 60\n| extend Distance = geo_distance_2points(Longitude, Latitude, PrevLongitude, PrevLatitude) \u002F 1000\n| where Distance > distance_threshold\n| project TimeGenerated, UserPrincipalName, IPAddress, Location, Distance, TimeDiff\n```\n\n```kql\n\u002F\u002F Detect AWS IAM credential abuse from CloudTrail\nAWSCloudTrail\n| where TimeGenerated > ago(24h)\n| where EventName in (\"ConsoleLogin\", \"AssumeRole\", \"GetSessionToken\")\n| where ErrorCode == \"\"\n| summarize LoginCount = count(), DistinctIPs = dcount(SourceIpAddress),\n            IPList = make_set(SourceIpAddress, 10)\n            by UserIdentityArn, bin(TimeGenerated, 1h)\n| where DistinctIPs > 3\n| project TimeGenerated, UserIdentityArn, LoginCount, DistinctIPs, IPList\n```\n\n```kql\n\u002F\u002F Detect mass S3 object deletion (potential ransomware)\nAWSCloudTrail\n| where TimeGenerated > ago(1h)\n| where EventName == \"DeleteObject\" or EventName == \"DeleteObjects\"\n| summarize DeleteCount = count(), BucketsAffected = dcount(RequestParameters_bucketName)\n            by UserIdentityArn, bin(TimeGenerated, 10m)\n| where DeleteCount > 100\n| project TimeGenerated, UserIdentityArn, DeleteCount, BucketsAffected\n```\n\n### Step 3: Build SOAR Playbooks with Logic Apps\n\nCreate automated response playbooks that execute when analytics rules trigger incidents. Common actions include blocking users, isolating resources, and enriching alerts with threat intelligence.\n\n```json\n{\n  \"definition\": {\n    \"triggers\": {\n      \"Microsoft_Sentinel_incident\": {\n        \"type\": \"ApiConnectionWebhook\",\n        \"inputs\": {\n          \"body\": {\"incidentArmId\": \"subscriptions\u002F@{triggerBody()?['workspaceInfo']?['SubscriptionId']}\u002FresourceGroups\u002F@{triggerBody()?['workspaceInfo']?['ResourceGroupName']}\u002Fproviders\u002FMicrosoft.OperationalInsights\u002Fworkspaces\u002F@{triggerBody()?['workspaceInfo']?['WorkspaceName']}\u002Fproviders\u002FMicrosoft.SecurityInsights\u002FIncidents\u002F@{triggerBody()?['object']?['properties']?['incidentNumber']}\"},\n          \"host\": {\"connection\": {\"name\": \"@parameters('$connections')['microsoftsentinel']['connectionId']\"}}\n        }\n      }\n    },\n    \"actions\": {\n      \"Get_incident_entities\": {\n        \"type\": \"ApiConnection\",\n        \"inputs\": {\"method\": \"post\", \"path\": \"\u002FIncidents\u002Fentities\"}\n      },\n      \"For_each_account_entity\": {\n        \"type\": \"Foreach\",\n        \"foreach\": \"@body('Get_incident_entities')?['Accounts']\",\n        \"actions\": {\n          \"Disable_Azure_AD_user\": {\n            \"type\": \"ApiConnection\",\n            \"inputs\": {\n              \"method\": \"PATCH\",\n              \"path\": \"\u002Fv1.0\u002Fusers\u002F@{items('For_each_account_entity')?['AadUserId']}\",\n              \"body\": {\"accountEnabled\": false}\n            }\n          },\n          \"Add_comment_to_incident\": {\n            \"type\": \"ApiConnection\",\n            \"inputs\": {\n              \"body\": {\"message\": \"User @{items('For_each_account_entity')?['Name']} disabled by automated playbook\"}\n            }\n          }\n        }\n      }\n    }\n  }\n}\n```\n\n### Step 4: Configure Sentinel Data Lake for Long-Term Hunting\n\nEnable the Sentinel data lake for petabyte-scale log retention and advanced threat hunting using both KQL and SQL endpoints.\n\n```kql\n\u002F\u002F Threat hunting query: detect lateral movement across AWS accounts\nlet suspicious_roles = AWSCloudTrail\n| where TimeGenerated > ago(7d)\n| where EventName == \"AssumeRole\"\n| extend AssumedRoleArn = tostring(parse_json(RequestParameters).roleArn)\n| where AssumedRoleArn contains \"cross-account\" or AssumedRoleArn contains \"admin\"\n| summarize AssumeCount = count(), UniqueSourceAccounts = dcount(RecipientAccountId)\n            by UserIdentityArn, AssumedRoleArn\n| where AssumeCount > 10 and UniqueSourceAccounts > 2;\nsuspicious_roles\n| join kind=inner (\n    AWSCloudTrail\n    | where TimeGenerated > ago(7d)\n    | where EventName in (\"RunInstances\", \"CreateFunction\", \"PutBucketPolicy\")\n) on UserIdentityArn\n| project TimeGenerated, UserIdentityArn, AssumedRoleArn, EventName, SourceIpAddress\n```\n\n### Step 5: Integrate Threat Intelligence\n\nConnect threat intelligence providers and create indicator-based matching rules to detect communication with known malicious infrastructure.\n\n```powershell\n# Enable Microsoft Threat Intelligence connector\naz sentinel data-connector create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --data-connector-id microsoft-ti \\\n  --kind MicrosoftThreatIntelligence \\\n  --microsoft-threat-intelligence '{\n    \"dataTypes\": {\"microsoftEmergingThreatFeed\": {\"lookbackPeriod\": \"2025-01-01T00:00:00Z\", \"state\": \"Enabled\"}}\n  }'\n```\n\n```kql\n\u002F\u002F Match network indicators against cloud flow logs\nlet TI_IPs = ThreatIntelligenceIndicator\n| where TimeGenerated > ago(30d)\n| where isnotempty(NetworkIP)\n| distinct NetworkIP;\nAzureNetworkAnalytics_CL\n| where TimeGenerated > ago(24h)\n| where DestIP_s in (TI_IPs)\n| project TimeGenerated, SrcIP_s, DestIP_s, DestPort_d, FlowType_s\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| KQL | Kusto Query Language, the primary query language for Microsoft Sentinel used to search, analyze, and visualize security data |\n| Analytics Rule | Detection logic in Sentinel that evaluates log data on a schedule and creates incidents when conditions match |\n| SOAR Playbook | Automated workflow triggered by incidents that performs response actions such as blocking accounts, enriching alerts, or notifying teams |\n| Data Connector | Integration module that ingests security logs from cloud services, identity providers, and third-party tools into Sentinel |\n| Sentinel Data Lake | Petabyte-scale storage layer providing long-term log retention with KQL and SQL query interfaces for advanced hunting |\n| Workbook | Interactive dashboard in Sentinel displaying visualizations of security data, trends, and operational metrics |\n| Watchlist | Reference data tables in Sentinel used to enrich alerts with context such as VIP user lists or approved IP ranges |\n| Fusion Detection | Machine learning-powered correlation engine that automatically detects multi-stage attacks across data sources |\n\n## Tools & Systems\n\n- **Microsoft Sentinel**: Cloud-native SIEM\u002FSOAR platform built on Azure Log Analytics with AI-powered threat detection\n- **Azure Logic Apps**: Low-code automation platform for building SOAR playbooks triggered by Sentinel incidents\n- **Microsoft Threat Intelligence**: Integrated threat feeds providing IP, domain, and URL indicators for matching against security logs\n- **Azure Data Explorer**: High-performance analytics engine underlying Sentinel KQL queries for large-scale data exploration\n- **MITRE ATT&CK Navigator**: Framework for mapping Sentinel detection rules to adversary tactics and techniques\n\n## Common Scenarios\n\n### Scenario: Detecting Cross-Cloud Credential Theft Campaign\n\n**Context**: An attacker compromises an Azure AD account through phishing, then uses the account to access AWS resources via federated identity. Sentinel needs to correlate the Azure sign-in anomaly with unusual AWS API activity.\n\n**Approach**:\n1. Create an analytics rule detecting Azure AD impossible travel or anomalous sign-in risk\n2. Write a KQL query correlating the compromised Azure AD identity with AWS CloudTrail AssumeRoleWithSAML events\n3. Build a Fusion detection rule that links Azure AD risk events with subsequent AWS privilege escalation activity\n4. Deploy a SOAR playbook that automatically disables the Azure AD account and revokes AWS STS sessions\n5. Create a workbook showing the timeline from initial compromise through lateral movement to AWS\n6. Run a hunting query across the data lake to check for similar patterns affecting other accounts\n\n**Pitfalls**: Not correlating identity across cloud providers misses the full attack chain. Setting analytics rule frequency too low (e.g., 24 hours) allows attackers hours of undetected access.\n\n## Output Format\n\n```\nMicrosoft Sentinel SOC Operations Report\n==========================================\nWorkspace: sentinel-workspace\nData Sources: 14 connectors active\nReport Period: 2025-02-01 to 2025-02-23\n\nDATA INGESTION:\n  Azure AD Sign-in Logs:     2.3 TB (23 days)\n  AWS CloudTrail:            1.8 TB (23 days)\n  Azure Activity:            0.9 TB (23 days)\n  Defender for Cloud Alerts: 45 GB (23 days)\n  Total Ingestion:           5.1 TB\n\nDETECTION SUMMARY:\n  Active Analytics Rules: 87\n  Incidents Created: 234\n    Critical: 8 | High: 34 | Medium: 89 | Low: 103\n  Mean Time to Detect (MTTD): 4.2 minutes\n  Mean Time to Respond (MTTR): 18 minutes\n\nTOP INCIDENT TYPES:\n  Impossible Travel Detected:          42 incidents\n  AWS Unauthorized API Call Pattern:   28 incidents\n  Mass File Deletion in S3:            3 incidents\n  Suspicious Azure AD App Registration: 12 incidents\n\nAUTOMATION:\n  Playbooks Executed: 156\n  Accounts Auto-Disabled: 23\n  Incidents Auto-Enriched: 198\n  False Positive Rate: 12%\n```\n","# Building Cloud SIEM with Sentinel\n\n## When to Use\n\n- When establishing a centralized security operations center for multi-cloud environments\n- When migrating from legacy SIEM platforms (Splunk, QRadar) to cloud-native architecture\n- When building automated incident response workflows for cloud-specific threats\n- When performing large-scale threat hunting across petabytes of security telemetry\n- When integrating threat intelligence feeds with cloud security log analysis\n\n**Do not use** for AWS-only environments where Security Hub and GuardDuty suffice, for endpoint detection requiring EDR capabilities (use Defender for Endpoint), or for compliance posture monitoring (see building-cloud-security-posture-management).\n\n## Prerequisites\n\n- Azure subscription with Microsoft Sentinel enabled on a Log Analytics workspace\n- Data connector permissions for target log sources (AWS CloudTrail, Azure Activity, GCP)\n- Logic Apps or Azure Functions for automated response playbooks\n- KQL (Kusto Query Language) proficiency for writing detection rules and hunting queries\n\n## Workflow\n\n### Step 1: Provision Sentinel Workspace and Data Connectors\n\nCreate a Log Analytics workspace optimized for security data and enable data connectors for multi-cloud ingestion.\n\n```powershell\n# Create Log Analytics workspace\naz monitor log-analytics workspace create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --location eastus \\\n  --retention-time 365 \\\n  --sku PerGB2018\n\n# Enable Microsoft Sentinel on the workspace\naz sentinel onboarding-state create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace\n\n# Enable AWS CloudTrail connector\naz sentinel data-connector create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --data-connector-id aws-cloudtrail \\\n  --kind AmazonWebServicesCloudTrail \\\n  --aws-cloud-trail-data-connector '{\n    \"awsRoleArn\": \"arn:aws:iam::123456789012:role\u002FSentinelCloudTrailRole\",\n    \"dataTypes\": {\"logs\": {\"state\": \"Enabled\"}}\n  }'\n\n# Enable Azure AD sign-in and audit logs\naz sentinel data-connector create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --data-connector-id azure-ad \\\n  --kind AzureActiveDirectory \\\n  --azure-active-directory '{\n    \"dataTypes\": {\n      \"alerts\": {\"state\": \"Enabled\"},\n      \"signinLogs\": {\"state\": \"Enabled\"},\n      \"auditLogs\": {\"state\": \"Enabled\"}\n    }\n  }'\n```\n\n### Step 2: Write KQL Detection Rules\n\nCreate analytics rules using Kusto Query Language to detect cloud-specific threats. Map each rule to MITRE ATT&CK techniques.\n\n```kql\n\u002F\u002F Detect impossible travel - sign-ins from geographically distant locations\nlet timeframe = 1h;\nlet distance_threshold = 500; \u002F\u002F km\nSigninLogs\n| where TimeGenerated > ago(timeframe)\n| where ResultType == 0 \u002F\u002F Successful sign-ins only\n| project TimeGenerated, UserPrincipalName, IPAddress, Location,\n          Latitude = toreal(LocationDetails.geoCoordinates.latitude),\n          Longitude = toreal(LocationDetails.geoCoordinates.longitude)\n| sort by UserPrincipalName asc, TimeGenerated asc\n| extend PrevLatitude = prev(Latitude, 1), PrevLongitude = prev(Longitude, 1),\n         PrevTime = prev(TimeGenerated, 1), PrevUser = prev(UserPrincipalName, 1)\n| where UserPrincipalName == PrevUser\n| extend TimeDiff = datetime_diff('minute', TimeGenerated, PrevTime)\n| where TimeDiff \u003C 60\n| extend Distance = geo_distance_2points(Longitude, Latitude, PrevLongitude, PrevLatitude) \u002F 1000\n| where Distance > distance_threshold\n| project TimeGenerated, UserPrincipalName, IPAddress, Location, Distance, TimeDiff\n```\n\n```kql\n\u002F\u002F Detect AWS IAM credential abuse from CloudTrail\nAWSCloudTrail\n| where TimeGenerated > ago(24h)\n| where EventName in (\"ConsoleLogin\", \"AssumeRole\", \"GetSessionToken\")\n| where ErrorCode == \"\"\n| summarize LoginCount = count(), DistinctIPs = dcount(SourceIpAddress),\n            IPList = make_set(SourceIpAddress, 10)\n            by UserIdentityArn, bin(TimeGenerated, 1h)\n| where DistinctIPs > 3\n| project TimeGenerated, UserIdentityArn, LoginCount, DistinctIPs, IPList\n```\n\n```kql\n\u002F\u002F Detect mass S3 object deletion (potential ransomware)\nAWSCloudTrail\n| where TimeGenerated > ago(1h)\n| where EventName == \"DeleteObject\" or EventName == \"DeleteObjects\"\n| summarize DeleteCount = count(), BucketsAffected = dcount(RequestParameters_bucketName)\n            by UserIdentityArn, bin(TimeGenerated, 10m)\n| where DeleteCount > 100\n| project TimeGenerated, UserIdentityArn, DeleteCount, BucketsAffected\n```\n\n### Step 3: Build SOAR Playbooks with Logic Apps\n\nCreate automated response playbooks that execute when analytics rules trigger incidents. Common actions include blocking users, isolating resources, and enriching alerts with threat intelligence.\n\n```json\n{\n  \"definition\": {\n    \"triggers\": {\n      \"Microsoft_Sentinel_incident\": {\n        \"type\": \"ApiConnectionWebhook\",\n        \"inputs\": {\n          \"body\": {\"incidentArmId\": \"subscriptions\u002F@{triggerBody()?['workspaceInfo']?['SubscriptionId']}\u002FresourceGroups\u002F@{triggerBody()?['workspaceInfo']?['ResourceGroupName']}\u002Fproviders\u002FMicrosoft.OperationalInsights\u002Fworkspaces\u002F@{triggerBody()?['workspaceInfo']?['WorkspaceName']}\u002Fproviders\u002FMicrosoft.SecurityInsights\u002FIncidents\u002F@{triggerBody()?['object']?['properties']?['incidentNumber']}\"},\n          \"host\": {\"connection\": {\"name\": \"@parameters('$connections')['microsoftsentinel']['connectionId']\"}}\n        }\n      }\n    },\n    \"actions\": {\n      \"Get_incident_entities\": {\n        \"type\": \"ApiConnection\",\n        \"inputs\": {\"method\": \"post\", \"path\": \"\u002FIncidents\u002Fentities\"}\n      },\n      \"For_each_account_entity\": {\n        \"type\": \"Foreach\",\n        \"foreach\": \"@body('Get_incident_entities')?['Accounts']\",\n        \"actions\": {\n          \"Disable_Azure_AD_user\": {\n            \"type\": \"ApiConnection\",\n            \"inputs\": {\n              \"method\": \"PATCH\",\n              \"path\": \"\u002Fv1.0\u002Fusers\u002F@{items('For_each_account_entity')?['AadUserId']}\",\n              \"body\": {\"accountEnabled\": false}\n            }\n          },\n          \"Add_comment_to_incident\": {\n            \"type\": \"ApiConnection\",\n            \"inputs\": {\n              \"body\": {\"message\": \"User @{items('For_each_account_entity')?['Name']} disabled by automated playbook\"}\n            }\n          }\n        }\n      }\n    }\n  }\n}\n```\n\n### Step 4: Configure Sentinel Data Lake for Long-Term Hunting\n\nEnable the Sentinel data lake for petabyte-scale log retention and advanced threat hunting using both KQL and SQL endpoints.\n\n```kql\n\u002F\u002F Threat hunting query: detect lateral movement across AWS accounts\nlet suspicious_roles = AWSCloudTrail\n| where TimeGenerated > ago(7d)\n| where EventName == \"AssumeRole\"\n| extend AssumedRoleArn = tostring(parse_json(RequestParameters).roleArn)\n| where AssumedRoleArn contains \"cross-account\" or AssumedRoleArn contains \"admin\"\n| summarize AssumeCount = count(), UniqueSourceAccounts = dcount(RecipientAccountId)\n            by UserIdentityArn, AssumedRoleArn\n| where AssumeCount > 10 and UniqueSourceAccounts > 2;\nsuspicious_roles\n| join kind=inner (\n    AWSCloudTrail\n    | where TimeGenerated > ago(7d)\n    | where EventName in (\"RunInstances\", \"CreateFunction\", \"PutBucketPolicy\")\n) on UserIdentityArn\n| project TimeGenerated, UserIdentityArn, AssumedRoleArn, EventName, SourceIpAddress\n```\n\n### Step 5: Integrate Threat Intelligence\n\nConnect threat intelligence providers and create indicator-based matching rules to detect communication with known malicious infrastructure.\n\n```powershell\n# Enable Microsoft Threat Intelligence connector\naz sentinel data-connector create \\\n  --resource-group security-rg \\\n  --workspace-name sentinel-workspace \\\n  --data-connector-id microsoft-ti \\\n  --kind MicrosoftThreatIntelligence \\\n  --microsoft-threat-intelligence '{\n    \"dataTypes\": {\"microsoftEmergingThreatFeed\": {\"lookbackPeriod\": \"2025-01-01T00:00:00Z\", \"state\": \"Enabled\"}}\n  }'\n```\n\n```kql\n\u002F\u002F Match network indicators against cloud flow logs\nlet TI_IPs = ThreatIntelligenceIndicator\n| where TimeGenerated > ago(30d)\n| where isnotempty(NetworkIP)\n| distinct NetworkIP;\nAzureNetworkAnalytics_CL\n| where TimeGenerated > ago(24h)\n| where DestIP_s in (TI_IPs)\n| project TimeGenerated, SrcIP_s, DestIP_s, DestPort_d, FlowType_s\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| KQL | Kusto Query Language, the primary query language for Microsoft Sentinel used to search, analyze, and visualize security data |\n| Analytics Rule | Detection logic in Sentinel that evaluates log data on a schedule and creates incidents when conditions match |\n| SOAR Playbook | Automated workflow triggered by incidents that performs response actions such as blocking accounts, enriching alerts, or notifying teams |\n| Data Connector | Integration module that ingests security logs from cloud services, identity providers, and third-party tools into Sentinel |\n| Sentinel Data Lake | Petabyte-scale storage layer providing long-term log retention with KQL and SQL query interfaces for advanced hunting |\n| Workbook | Interactive dashboard in Sentinel displaying visualizations of security data, trends, and operational metrics |\n| Watchlist | Reference data tables in Sentinel used to enrich alerts with context such as VIP user lists or approved IP ranges |\n| Fusion Detection | Machine learning-powered correlation engine that automatically detects multi-stage attacks across data sources |\n\n## Tools & Systems\n\n- **Microsoft Sentinel**: Cloud-native SIEM\u002FSOAR platform built on Azure Log Analytics with AI-powered threat detection\n- **Azure Logic Apps**: Low-code automation platform for building SOAR playbooks triggered by Sentinel incidents\n- **Microsoft Threat Intelligence**: Integrated threat feeds providing IP, domain, and URL indicators for matching against security logs\n- **Azure Data Explorer**: High-performance analytics engine underlying Sentinel KQL queries for large-scale data exploration\n- **MITRE ATT&CK Navigator**: Framework for mapping Sentinel detection rules to adversary tactics and techniques\n\n## Common Scenarios\n\n### Scenario: Detecting Cross-Cloud Credential Theft Campaign\n\n**Context**: An attacker compromises an Azure AD account through phishing, then uses the account to access AWS resources via federated identity. Sentinel needs to correlate the Azure sign-in anomaly with unusual AWS API activity.\n\n**Approach**:\n1. Create an analytics rule detecting Azure AD impossible travel or anomalous sign-in risk\n2. Write a KQL query correlating the compromised Azure AD identity with AWS CloudTrail AssumeRoleWithSAML events\n3. Build a Fusion detection rule that links Azure AD risk events with subsequent AWS privilege escalation activity\n4. Deploy a SOAR playbook that automatically disables the Azure AD account and revokes AWS STS sessions\n5. Create a workbook showing the timeline from initial compromise through lateral movement to AWS\n6. Run a hunting query across the data lake to check for similar patterns affecting other accounts\n\n**Pitfalls**: Not correlating identity across cloud providers misses the full attack chain. Setting analytics rule frequency too low (e.g., 24 hours) allows attackers hours of undetected access.\n\n## Output Format\n\n```\nMicrosoft Sentinel SOC Operations Report\n==========================================\nWorkspace: sentinel-workspace\nData Sources: 14 connectors active\nReport Period: 2025-02-01 to 2025-02-23\n\nDATA INGESTION:\n  Azure AD Sign-in Logs:     2.3 TB (23 days)\n  AWS CloudTrail:            1.8 TB (23 days)\n  Azure Activity:            0.9 TB (23 days)\n  Defender for Cloud Alerts: 45 GB (23 days)\n  Total Ingestion:           5.1 TB\n\nDETECTION SUMMARY:\n  Active Analytics Rules: 87\n  Incidents Created: 234\n    Critical: 8 | High: 34 | Medium: 89 | Low: 103\n  Mean Time to Detect (MTTD): 4.2 minutes\n  Mean Time to Respond (MTTR): 18 minutes\n\nTOP INCIDENT TYPES:\n  Impossible Travel Detected:          42 incidents\n  AWS Unauthorized API Call Pattern:   28 incidents\n  Mass File Deletion in S3:            3 incidents\n  Suspicious Azure AD App Registration: 12 incidents\n\nAUTOMATION:\n  Playbooks Executed: 156\n  Accounts Auto-Disabled: 23\n  Incidents Auto-Enriched: 198\n  False Positive Rate: 12%\n```\n",{"name":5,"tags":49,"capec":54,"model":55,"tools":56,"domain":43,"maxTurns":60,"nist_csf":61,"subdomain":66,"description":7,"nist_ai_rmf":67,"mitre_attack":71,"atlas_techniques":74},[38,50,51,52,53],"cloud-siem","kql-queries","soar-automation","threat-detection",[],"sonnet",[57,37,58,59],"Read","Glob","Grep",20,[62,63,64,65],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01","cloud-security",[68,69,70],"MEASURE-2.7","MAP-5.1","MANAGE-2.4",[72,73],"T1059","T1070",[75,76,77],"AML.T0070","AML.T0066","AML.T0082","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud\u002Fazure\u002Fsentinel\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":86,"prompt":96,"zipAvailable":97},[87,90,93],{"tool":88,"command":89},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill azure-sentinel-detect",{"tool":91,"command":92},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill azure-sentinel-detect",{"tool":94,"command":95},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill azure-sentinel-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fazure\u002Fsentinel\u002Fdetect\u002FSKILL.md",true,[99],{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"index.json","REFERENCE","参考文档",674,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fazure\u002Fsentinel\u002Fdetect\u002Findex.json",[106,129,150,171,193,209],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[113,26,114,115,116,117,34,118,119,120,121,122,123,124,125,126,127,43,128],"services","services wmi persistence detect","wmi","persistence","de","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":135,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[136,113,137,115,138,139,140,43,37,141,142,31,143,144,117,145,146,147,148,149],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":156,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[157,158,159,160,161,162,43,37,163,141,164,165,117,147,166,167,168,169,170,55],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":177,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[26,178,179,180,181,182,183,34,184,43,128,185,186,187,188,189,190,191,192,117],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":194,"name":195,"nameZh":6,"description":196,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":197,"categories":198,"keywords":199,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[200,201,26,202,180,182,203,34,204,184,43,128,141,205,206,207,208,192,117,118],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":215,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[216,26,180,217,203,34,218,219,43,128,220,221,222,223,224,225,117,118,226,227],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]