This project demonstrates the setup of a basic Security Operations Center (SOC) environment in Microsoft Azure using a honeypot. A Windows virtual machine is intentionally exposed to capture incoming traffic, while logs are collected, enriched, and analyzed using Azure Log Analytics Workspace and Microsoft Sentinel.
The goal of this lab is to understand how security events are generated, collected, and analyzed in a cloud environment.
The environment was built by creating a resource group and deploying a virtual network and a Windows virtual machine (CORP-NET-EAST-2). The machine was deliberately configured to allow inbound traffic in order to simulate a vulnerable system.
A Log Analytics Workspace was used as the central log repository, and Microsoft Sentinel was connected to it for monitoring and analysis. Logs generated by the virtual machine are collected through Azure Monitor and made available in Sentinel for investigation and visualization.
The main objectives of this lab were:
- Deploy and configure a virtual machine as a honeypot
- Configure Network Security Group rules to allow inbound traffic
- Generate and analyze security events from failed login attempts
- Set up a Log Analytics Workspace for centralized logging
- Connect Microsoft Sentinel for monitoring and analysis
- Query logs using Kusto Query Language (KQL)
- Enrich logs with geographic data using watchlists
- Visualize attack data using Sentinel workbooks
- Microsoft Azure
- Azure Virtual Machines
- Log Analytics Workspace
- Microsoft Sentinel
- Azure Monitor
- Kusto Query Language (KQL)
The project is divided into the following parts:
- Azure Subscription Setup
- Resource Group Configuration
- Honeypot Virtual Machine Deployment
- Log Generation and Analysis
- Log Analytics Workspace Setup
- Microsoft Sentinel Integration
- Log Querying using KQL
- Watchlist Creation for GeoIP Data
- Log Enrichment
- Workbook Visualization
Detailed steps and screenshots are included below in this README.
- Part 1: Azure Subscription Setup
- Part 2: Resource Group
- Part 3: Creating the Honey Pot (Azure Virtual Machine)
- Part 4: Logging into the VM and Inspecting Logs
- Part 5: Log Analytics Workspace (LAW) Creation
- Part 6: Microsoft Sentinel Instance Creation and Connection
- Part 7: Querying Logs within the LAW
- Part 8: Sentinel Watchlist Creation (GeoId Database Import)
- Part 9: Log Enrichment Query
- Part 10: Sentinel Workbook Creation
The lab begins with setting up an Azure subscription, either using the free tier or an existing paid account.
This lab focuses on building a basic honeypot in Azure and monitoring activity through centralized logging. It includes configuring a Log Analytics Workspace and Microsoft Sentinel, enriching logs with geographic data, and visualizing potential attack sources.
Architecture diagram:
https://github.com/EffaAzhar/Azure-SOC-Honeypot-/blob/main/Lab_Screenshots/Lab%20Architecture.png
A resource group named RG-SOC-Lab was created to organize all resources used in the lab.
Resources included:
- Virtual Machine: CORP-NET-EAST-2
- Virtual Network: Vnet-soc-lab
- Public IP Address: CORP-NET-EAST-2ip
- Network Security Group: CORP-NET-EAST-2nsg
- Disk and Network Interface attached to the VM
Screenshot:
https://github.com/EffaAzhar/Azure-SOC-Honeypot-/blob/main/Lab_Screenshots/Resource%20Group.png
A Windows 10 virtual machine was deployed to act as the honeypot. The system was intentionally left exposed to capture incoming traffic and potential malicious activity.
- A Network Security Group rule was configured to allow all inbound traffic
- Windows Firewall was disabled on the VM
This configuration is intentionally insecure and would not be used in a production environment. It was done to ensure that all connection attempts are captured for analysis.
To generate activity, several failed login attempts were made using a non-existent username ("employee"). These attempts produced security logs for analysis.
A Log Analytics Workspace named Law-Soc-lab was created to act as a central repository for collecting and storing logs from the virtual machine.
Microsoft Sentinel was deployed and connected to the Log Analytics Workspace.
The data flow is as follows:
- The virtual machine generates logs
- Azure Monitor Agent collects the logs
- Logs are sent to the workspace
- Sentinel accesses and analyzes the data
Screenshot:
https://github.com/EffaAzhar/Azure-SOC-Honeypot-/blob/main/Lab_Screenshots/Log%20Analysis%201.png
Kusto Query Language (KQL) was used to query the collected logs in the workspace and review security events.
Screenshot:
https://github.com/EffaAzhar/Azure-SOC-Honeypot-/blob/main/Lab_Screenshots/Log%20Analysis%202.png
The initial logs only contained IP addresses without location details. To add context, a GeoIP dataset (CSV file) was imported into Sentinel as a watchlist named geoid.
This allowed mapping of IP addresses to geographic locations.
A KQL query was used to join security logs with the GeoIP watchlist using the IP address field.
The ipv4_lookup() function was used to enrich the logs with geographic information, making the data more useful for analysis.
Screenshot:
https://github.com/EffaAzhar/Azure-SOC-Honeypot-/blob/main/Lab_Screenshots/Log%20Analysis%20KQL%20mode.png
A workbook was created in Microsoft Sentinel to visualize the collected and enriched data.
This provides a clear view of activity patterns and helps identify the origin of potential attacks.
This project demonstrates proficiency in the following areas:
- Cloud Computing (Microsoft Azure): Virtual machine deployment and network configuration.
- Security Information and Event Management (SIEM): Microsoft Sentinel setup and configuration.
- Log Management and Analysis: Utilizing Azure Log Analytics Workspace for centralized logging.
- Data Connectors: Configuring data ingestion from Windows VMs into Sentinel.
- Kusto Query Language (KQL): Writing and executing queries for log analysis and enrichment.
- Threat Intelligence: Integrating and utilizing IP-based geographic data for enrichment..
- Understanding of Security Concepts: Honeypots, failed login analysis, and basic threat detection.
- Implement more advanced honeypot techniques
- Integrate additional log sources for broader visibility
- Develop more advanced detection queries
- Automate responses to suspicious activity
This project provides a foundational understanding of building a basic threat detection and analysis pipeline in a cloud environment. By setting up a honeypot, centralizing logs, and enriching data this project highlights key skills relevant to Security Operations roles.