This project demonstrates an end-to-end Security Operations Center (SOC) workflow for investigating a simulated phishing email using Microsoft Azure security services.
The lab combines:
- Microsoft Sentinel SIEM
- Microsoft Defender for Endpoint integration
- KQL
- IOC Watchlists
- MITRE ATT&CK
- Sentinel Analytics Rules
- Microsoft Sentinel SOAR / Logic Apps
- Automated incident response
- SOC incident documentation
The objective was to simulate how a SOC analyst detects, investigates, triages, automates response to, and resolves a phishing incident.
Lab Disclaimer: This is a controlled cybersecurity simulation. The phishing indicators and email scenario were intentionally created for the lab. No real malicious email, production account, or compromised system was involved.
Simulated Phishing Email
|
v
IOC Extraction
|
v
Microsoft Sentinel
|
+---------+---------+
| |
v v
IOC Watchlist KQL Detection
| |
+---------+---------+
|
v
Analytics Rule
"Phishing IOC Detection"
|
v
High Severity Alert
|
v
Sentinel Incident
|
v
MITRE ATT&CK Mapping
T1566.002
|
v
Automation Rule
AR-Phishing-SOAR
|
v
SOAR Logic App Playbook
PB-Phishing-Incident-Response
|
+------------+------------+
| | |
v v v
Get Incident Add Comment Update Incident
| | |
+------------+------------+
|
v
Analyst Review
|
v
Incident Resolved
- Azure Subscription: Azure for Students
- Microsoft Sentinel
- Log Analytics Workspace:
law-soc-phishing - Resource Group:
rg-soc-phishing
- Playbook:
PB-Phishing-Incident-Response - Automation Rule:
AR-Phishing-SOAR
- Microsoft Defender for Endpoint Sentinel solution
- Microsoft Defender for Endpoint data connector
- Status: Connected
A simulated Microsoft 365 account-verification phishing email was used for the investigation.
Sender: security-alert@micr0soft-support.com
Target: employee@company.local
Suspicious URL: https://micr0soft-login.example.com/verify
- Microsoft 365 impersonation
- Typosquatting
- Urgency
- Account verification request
- Suspicious authentication URL
The following simulated indicators were extracted:
| Type | Indicator | Description |
|---|---|---|
security-alert@micr0soft-support.com |
Suspicious sender | |
| Domain | micr0soft-support.com |
Typosquatting domain |
| URL | https://micr0soft-login.example.com/verify |
Phishing URL |
| Domain | micr0soft-login.example.com |
Suspicious login domain |
The 0 character in micr0soft was intentionally used to simulate a typosquatting technique.
The indicators were added to a Microsoft Sentinel Watchlist: PhishingIOCs
A KQL-based Analytics Rule was created: Phishing IOC Detection
- Severity: High
- Frequency: Every 5 minutes
- Lookup period: Last 5 minutes
- Trigger: More than 0 results
- Incident creation: Enabled
The rule successfully generated a Sentinel phishing incident.
The phishing scenario was mapped to:
| Tactic | Technique |
|---|---|
| Initial Access | T1566 — Phishing |
| Initial Access | T1566.002 — Phishing: Spearphishing Link |
The phishing URL represents the primary technique demonstrated by the simulation.
ID: 20
Name: Phishing IOC Detection
Severity: High
Classification: True Alert
Status: Resolved
The incident was investigated using the simulated sender, domain, and URL indicators.
The incident automatically triggered AR-Phishing-SOAR, which executed PB-Phishing-Incident-Response.
- Microsoft Sentinel incident trigger
- Get incident
- Add automated SOC comment
- Update incident
Automated SOC triage: Phishing IOC detected. Incident requires analyst investigation.
The final playbook execution completed successfully with all four actions successful.
The automated workflow reduced repetitive SOC analyst actions by:
- Retrieving incident information
- Documenting automated triage
- Updating the incident
- Maintaining consistent response handling
The incident was subsequently classified as a True Alert and Resolved.
- Simulated phishing email
- IOC extraction
- Phishing analysis
Status: Completed
- Sentinel deployment
- MDE Sentinel integration
- IOC Watchlist
- KQL detection
- Analytics Rule
- MITRE ATT&CK mapping
- Incident generation
Status: Completed
- Logic App Playbook
- Managed Identity
- Sentinel permissions
- Automation Rule
- Automated incident response
- Successful playbook execution
- Incident resolution
Status: Completed
- Incident Report
- MITRE Mapping
- SOAR Workflow
- KQL Documentation
- README
Status: Completed
SOC-Phishing-Investigation/
│
├── 01_Email_Analysis/
│ └── phishing_iocs.csv
│
├── 02_Sentinel/
│ ├── 04_MDE_Connector_Connected.png
│ ├── 05_Sentinel_Test_Data.png
│ ├── 06_Phishing_Detection_KQL.png
│ ├── 07_Phishing_IOC_Watchlist.png
│ ├── 08_Watchlist_IOC_Detection.png
│ ├── 09_Phishing_Analytics_Rule.png
│ └── 19_Analytics_Rule_Final.png
│
├── 03_SOAR/
│ ├── 10_SOAR_Playbook.png
│ ├── 11_SOAR_Automation_Rule.png
│ ├── 12_Playbook_Execution_Success.png
│ ├── 17_Playbook_Successful_Run.png
│ ├── 20_Automation_Rule_Final.png
│ ├── 21_Active_Playbook_Final.png
│ ├── 22_Playbook_Architecture.png
│ └── 23_Playbook_Overview.png
│
├── 04_Reports/
│ ├── Incident_Report.md
│ ├── MITRE_Mapping.md
│ ├── SOAR_Workflow.md
│ ├── KQL_Detections.md
│ ├── 13_Incident_Automation_Activity.png
│ ├── 14_Incident_Details_MITRE.png
│ ├── 15_Incident_Activity_Completed.png
│ ├── 16_Incident_Resolved.png
│ └── 18_Incident_Summary.png
│
└── README.md
This project demonstrates practical SOC skills including:
- Phishing investigation
- IOC extraction
- SIEM monitoring
- Microsoft Sentinel
- KQL
- Watchlist management
- Alert triage
- Incident investigation
- Severity classification
- MITRE ATT&CK
- SOAR
- Logic Apps
- Managed identities
- Automated response
- Incident documentation
This phishing scenario was also used to build an independent automated triage pipeline using n8n + Google Gemini + VirusTotal, simulating how AI can assist SOC L1 analysts. See 05_n8n_AI_Automation/README.md
The project can be extended with:
- Microsoft Defender for Endpoint device telemetry
- Microsoft Defender XDR
- Email security telemetry
- Threat intelligence enrichment
- Automated IOC blocking
- User notification
- Account containment
- Endpoint isolation
- Active Directory integration
- Additional phishing detection rules
The project demonstrates the complete SOC workflow:
Detect → Investigate → Triage → Map → Automate → Respond → Resolve → Document
It provides a practical demonstration of how Microsoft Sentinel and SOAR can be used to automate repetitive phishing incident response tasks while maintaining analyst visibility and control.