Azure Honeypot & SIEM Attack-Analysis Lab

Completed: October 5, 2025

This project explains how I built a cloud-based cybersecurity home lab using Microsoft Sentinel with an Azure virtual machine to detect and display attack data.

Based on a tutorial by Josh Madakor.
All implementation, exploration, and documentation conducted independently as part of my cybersecurity learning journey.

---

Project Overview

This project showcases how I established a cloud-based honeypot VM in Azure and sent brute-force attempt logs to a SIEM workspace. The workspace was integrated into Microsoft Sentinel to identify failed login attempts, conduct geolocation IP filtering, and visualize source locations on a live attack map. I wrote KQL queries for event filtering, analyzing, and alert creation; acquiring hands-on experience in SIEM operations, log analytics, and security monitoring.

Tech Stack

Category	Tool / Platform
Cloud Platform	Microsoft Azure
SIEM	Microsoft Sentinel
Data Ingestion	Log Analytics Workspace
OS	Windows Server 2022
Scripting	PowerShell
Query Language	KQL (Kusto Query Language)
API	IP-API.com (Geolocation)

---

Architecture Diagram

1. Internet Attackers discover and attempt to login to Azure VM Honeypot
2. Failed login attempts are captured in Windows Event Logs
3. Windows Event Logs are funneled into a Log Analytics Workspace
4. Microsoft Sentinel with KQL Filters use the workspace to create an attack map visualization

---

Step-by-Step Setup

1️⃣ Create an Azure Environment

1. Begin with a free Azure subscription and create a resource group for easy cleanup. Put all resources here.
2. Create a virtual network and network security group, naming them logically (e.g. "RG-SOC-Lab". "Vnet-SOC-Lab", "LAW-Sentinel")

---

2️⃣ Setup and deploy the Honeypot VM

1. Create a Windows 10 Pro Server VM (2 vcpus, 8 GiB memory).
2. Set up a strong password. Use letters (uppercase/lowercase) with numbers, symbols, and minimum 10-15 characters.
3. Configure an inbound port rule in the VM's network security group (NSG) that exposes RDP (port 3389) to the internet.
   • Remote Desktop Protocol (RDP) lets a user view and interact with a remote computer's desktop.

4. Login and disable Windows Defender Firewall (start -> wf.msc -> properties -> all off)

This configuraton intentionally exposes the VM to the public internet for educational purposes only, allowing observation of real-world brute-force activity.

Security Disclaimer: This lab is deployed in an isolated Azure environment with no personal data. Exposed services should be avoided in real-world production environments.

---

3️⃣ Observe Local Logs

After deployment, attack traffic is not immediate. Brute-force attempts typically begin appearing within several hours to a day after exposing RDP, depending on automated scanning activity.

Open Event Viewer -> Windows Logs -> Security to view incoming failed login attempts (Event ID 4625). Here you can view attempted usernames, IPs, and timestamps.

---

4️⃣ Create a Log Analytics Workspace and link to Microsoft Sentinel

1. Create both a new Log Analytics Workspace (LAW) and Microsoft Sentinel workspace under your resource group.

   The Log Analytics Workspace will act as a centralized storage and analysis hub for incoming logs from your VM. Microsoft Sentinel adds threat detection, alerting, and visualization capabilities. Feel free to explore its built-in workbooks and analytic rules.

2. On Microsoft Sentinel, add the previously created Log Analytics Workspace. This links the LAW to its respective SIEM.

3. Under Content Management > Content Hub search for and install Windows Security Events.

4. Under Windows Security Events, click on "manage" and install "Windows Security Events via AMA".

Azure Monitoring Agent (AMA) allows all security events from the Windows machine to stream directly into the Microsoft Sentinel workspace.

5. Once installed, open connector page and create a new data collection rule. Select your VM under the resources tab and collect All Security Events. It may take a moment for the extension to be applied to the VM.

---

5️⃣ Query for logs within the LAW

1. Observe some of the ingested logs using KQL filters. To start, enter "SecurityEvent" in a new query and press "Run". It will output all security related logs.

2. To filter for attacker's failed login alerts, set | where EventID == 4625 under SecurityEvent. You can also filter using Account, TimeGenerated, Computer, Activity, and IpAddress information using a pipe under the field named "project". The pipe passes the result of one command as input to the next command.

SecurityEvent   
    | where EventId == 4625  

---

6️⃣ Enrich Logs with Geolocation Data

1. The LAW does not include a native geolocation table. A custom table containing IP-to-geolocation mappings needs to be imported into Sentinel first. To do this, download this spreadsheet from Google Drive: geoip-summarized.csv

   alternative link: https://raw.githubusercontent.com/joshmadakor1/lognpacific-public/refs/heads/main/misc/geoip-summarized.csv

2. Within Sentinel, create the watchlist titled "geoip" as a local file with the search key "network" and upload the above .csv spreadsheet.

3. Using KQL, you can now filter utilizing the watchlist table:

let GeoIPDB_FULL = _GetWatchlist("geoip");  
let WindowsEvents = SecurityEvent    
    | where IpAddress == (attacker IP address)  
    | where EventID == 4625  
    | order by TimeGenerated desc  
    | evaluate ipv4_lookup(GeoIPDB_FULL, IpAddress, network);  
WindowsEvents

(insert a random attacker IP address)

---

7️⃣ Build the Attack Map in Sentinel

1. On a new tab, go to Sentinel and create a new workbook that will be our attack map.
2. Add a query and paste the following JSON code into the advanced editor:

{
	"type": 3,
	"content": {
	"version": "KqlItem/1.0",
	"query": "let GeoIPDB_FULL = _GetWatchlist(\"geoip\");\nlet WindowsEvents = SecurityEvent;\nWindowsEvents | where EventID == 4625\n| order by TimeGenerated desc\n| evaluate ipv4_lookup(GeoIPDB_FULL, IpAddress, network)\n| summarize FailureCount = count() by IpAddress, latitude, longitude, cityname, countryname\n| project FailureCount, AttackerIp = IpAddress, latitude, longitude, city = cityname, country = countryname,\nfriendly_location = strcat(cityname, \" (\", countryname, \")\");",
	"size": 3,
	"timeContext": {
		"durationMs": 2592000000
	},
	"queryType": 0,
	"resourceType": "microsoft.operationalinsights/workspaces",
	"visualization": "map",
	"mapSettings": {
		"locInfo": "LatLong",
		"locInfoColumn": "countryname",
		"latitude": "latitude",
		"longitude": "longitude",
		"sizeSettings": "FailureCount",
		"sizeAggregation": "Sum",
		"opacity": 0.8,
		"labelSettings": "friendly_location",
		"legendMetric": "FailureCount",
		"legendAggregation": "Sum",
		"itemColorSettings": {
		"nodeColorField": "FailureCount",
		"colorAggregation": "Sum",
		"type": "heatmap",
		"heatmapPalette": "greenRed"
		}
	}
	},
	"name": "query - 0"
}

3. You can freely adjust colors, bubble sizes, etc under map settings in the edit query tab.

Like I discussed earlier, attack traffic isn't immediate. Brute-force attempts appearing may take several hours to a day after exposal to the internet. I ran mine for around 30 minutes and these were my results:

---

Future Improvements

• Utilize Azure Functions or Logic apps to automate elements like the enrichment process
• Implement more data sources such as firewall logs, threat intelligence feeds, etc.
• Add custom Sentinel alerts for specific attack signatures
• Integrate Power BI or Grafana for improved map visualizations

---

Skills Demonstrated

• Azure virtual machine deployment
• Microsoft Sentinel SIEM configuration
• Windows Event Log analysis
• KQL querying and filtering
• Geolocation enrichment of security events
• Cloud security monitoring fundamentals

---

Reflection

This project showed me how active the internet threat landscape is. A simple exposed VM became a global target in a matter of minutes with over 35,000 brute-force attempts. It also deepened my understanding of KQL filtering methods such as log pipelines, data enrichment, and SIEM workflows. These are all essential skills for anyone pursuing a SOC analyst or threat detection position in cybersecurity.

Thank you for reading and checking out my project!

---