building-cloud-siem-with-sentinel

name	building-cloud-siem-with-sentinel
description	Deploy Microsoft Sentinel as a cloud-native SIEM and SOAR platform for Azure. Covers configuring data connectors (Entra ID, Azure Activity), writing KQL detection queries, and building automated response playbooks.
domain	cybersecurity
subdomain	security-operations
tags	["microsoft-sentinel","cloud-siem","kql-queries","soar-automation","threat-detection","azure"]
version	1.0
author	openshield
license	Apache-2.0
nist_csf	["DE.CM-1","DE.CM-3","DE.CM-7","DE.AE-3","RS.AN-1"]

Building Cloud SIEM with Sentinel — Azure Focused

When to Use

• When establishing a centralized security operations center (SOC) for Azure.
• When building automated incident response workflows for Azure-specific threats.
• When performing threat hunting across Azure security telemetry using KQL.
• When integrating threat intelligence feeds with Azure Activity and Entra ID logs.

Key Concepts

Term	Definition
KQL	Kusto Query Language, used for searching and analyzing data in Sentinel
Analytics Rule	Detection logic that creates incidents when specific conditions match
SOAR Playbook	Automated workflow triggered by incidents to perform response actions
Data Connector	Module that ingests security logs from Azure services into Sentinel

OpenShield Monitoring Rules

OpenShield identifies gaps in the logging required for an effective SIEM:

• Logging: AZ-STOR-004 (Diagnostic Logs), AZ-IDN-009 (Role Assignment Alerts)
• Identity: AZ-IDN-007 (MFA Status), AZ-IDN-002 (Conditional Access)

SIEM Workflow

Step 1: Provision Sentinel

Enable Microsoft Sentinel on a Log Analytics workspace.

Step 2: Enable Connectors

Ingest Entra ID Sign-in/Audit logs and Azure Activity logs.

Step 3: Write Detection Queries

Example: Detect impossible travel or mass resource deletions.

Step 4: Automate Response

Use Logic Apps to automatically disable compromised Entra ID accounts.

Remediation Reference

• Enable Diagnostic Settings: Ensure all critical resources send logs to the Sentinel workspace.
• Use Fusion Rules: Enable Sentinel's multi-stage attack detection (Fusion) for high-fidelity alerts.
• Automate Remediation: Link OpenShield findings to Sentinel incidents for automated response.