一键在 Manus 中运行任何 Skill

building-cloud-siem-with-sentinel

星标54

分支65

更新时间2026年6月21日 23:49

Deploy Microsoft Sentinel as a cloud-native SIEM and SOAR platform for Azure. Covers configuring data connectors (Entra ID, Azure Activity), writing KQL detection queries, and building automated response playbooks.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

openshield-org

openshield-org/openshield

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

Building Cloud SIEM with Sentinel — Azure Focused

When to Use

When establishing a centralized security operations center (SOC) for Azure.
When building automated incident response workflows for Azure-specific threats.
When performing threat hunting across Azure security telemetry using KQL.
When integrating threat intelligence feeds with Azure Activity and Entra ID logs.

Key Concepts

Term	Definition
KQL	Kusto Query Language, used for searching and analyzing data in Sentinel
Analytics Rule	Detection logic that creates incidents when specific conditions match
SOAR Playbook	Automated workflow triggered by incidents to perform response actions
Data Connector	Module that ingests security logs from Azure services into Sentinel

OpenShield Monitoring Rules

OpenShield identifies gaps in the logging required for an effective SIEM:

Logging: AZ-STOR-004 (Diagnostic Logs), AZ-IDN-009 (Role Assignment Alerts)
Identity: AZ-IDN-007 (MFA Status), AZ-IDN-002 (Conditional Access)

SIEM Workflow

Step 1: Provision Sentinel

Enable Microsoft Sentinel on a Log Analytics workspace.

Step 2: Enable Connectors

Ingest Entra ID Sign-in/Audit logs and Azure Activity logs.

Step 3: Write Detection Queries

Example: Detect impossible travel or mass resource deletions.

Step 4: Automate Response

Use Logic Apps to automatically disable compromised Entra ID accounts.

Remediation Reference

Enable Diagnostic Settings: Ensure all critical resources send logs to the Sentinel workspace.
Use Fusion Rules: Enable Sentinel's multi-stage attack detection (Fusion) for high-fidelity alerts.
Automate Remediation: Link OpenShield findings to Sentinel incidents for automated response.

同仓库更多 Skills

同仓库

post-quantum-cryptography-azure

openshield-org/openshield

Identifies and remediates non-quantum-safe cryptographic configurations in Azure including classical TLS key exchange, RSA and ECC keys in Key Vault, and classical certificate algorithms. Maps findings to NIST PQC standards FIPS 203, FIPS 204, and FIPS 205. Use when assessing quantum readiness of Azure infrastructure or building a Cryptographic Bill of Materials.

2026-07-1454

analyzing-azure-activity-logs-for-threats

openshield-org/openshield

Queries Azure Monitor activity logs and sign-in logs to detect suspicious administrative operations, impossible travel, and privilege escalation.

2026-06-2154

analyzing-cloud-storage-access-patterns

openshield-org/openshield

Detect abnormal access patterns in Azure Blob Storage by analyzing Storage Analytics and diagnostic logs. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetBlob spikes), and potential data exfiltration.

2026-06-2154

auditing-azure-active-directory-configuration

openshield-org/openshield

Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, and guest user risks.

2026-06-2154

auditing-cloud-with-cis-benchmarks

openshield-org/openshield

Conduct cloud security audits using Center for Internet Security (CIS) benchmarks for Azure. Covers interpreting CIS Foundations Benchmark controls, running automated assessments, and maintaining continuous compliance monitoring.

2026-06-2154

building-identity-federation-with-saml-azure-ad

openshield-org/openshield

Establish SAML 2.0 identity federation between on-premises Active Directory and Microsoft Entra ID (Azure AD) for seamless cross-domain authentication and SSO.

2026-06-2154

name	building-cloud-siem-with-sentinel
description	Deploy Microsoft Sentinel as a cloud-native SIEM and SOAR platform for Azure. Covers configuring data connectors (Entra ID, Azure Activity), writing KQL detection queries, and building automated response playbooks.
domain	cybersecurity
subdomain	security-operations
tags	["microsoft-sentinel","cloud-siem","kql-queries","soar-automation","threat-detection","azure"]
version	1.0
author	openshield
license	Apache-2.0
nist_csf	["DE.CM-1","DE.CM-3","DE.CM-7","DE.AE-3","RS.AN-1"]

Building Cloud SIEM with Sentinel — Azure Focused

When to Use

When establishing a centralized security operations center (SOC) for Azure.
When building automated incident response workflows for Azure-specific threats.
When performing threat hunting across Azure security telemetry using KQL.
When integrating threat intelligence feeds with Azure Activity and Entra ID logs.

Key Concepts

Term	Definition
KQL	Kusto Query Language, used for searching and analyzing data in Sentinel
Analytics Rule	Detection logic that creates incidents when specific conditions match
SOAR Playbook	Automated workflow triggered by incidents to perform response actions
Data Connector	Module that ingests security logs from Azure services into Sentinel

OpenShield Monitoring Rules

OpenShield identifies gaps in the logging required for an effective SIEM:

Logging: AZ-STOR-004 (Diagnostic Logs), AZ-IDN-009 (Role Assignment Alerts)
Identity: AZ-IDN-007 (MFA Status), AZ-IDN-002 (Conditional Access)

SIEM Workflow

Step 1: Provision Sentinel

Enable Microsoft Sentinel on a Log Analytics workspace.

Step 2: Enable Connectors

Ingest Entra ID Sign-in/Audit logs and Azure Activity logs.

Step 3: Write Detection Queries

Example: Detect impossible travel or mass resource deletions.

Step 4: Automate Response

Use Logic Apps to automatically disable compromised Entra ID accounts.

Remediation Reference

Enable Diagnostic Settings: Ensure all critical resources send logs to the Sentinel workspace.
Use Fusion Rules: Enable Sentinel's multi-stage attack detection (Fusion) for high-fidelity alerts.
Automate Remediation: Link OpenShield findings to Sentinel incidents for automated response.