Microsoft Sentinel, SIEM, SOAR, KQL, SOC Operations: Explore cloud-native security monitoring, threat detection, incident investigation, and automated response workflows.
-
Updated
Jul 14, 2026
#
microsoft-sentinel-kql
Here are 4 public repositories matching this topic...
A Microsoft Sentinel SOC homelab in Azure, where I built and validated a basic cloud SOC workflow: data onboarding, detection, investigation, and visualization. It demonstrates practical blue-team skills in SIEM operations, KQL-based threat hunting, watchlist enrichment, and workbook reporting.
microsoft-azure microsoft-sentinel kql-threathunting incident-triage soc-analysis microsoft-sentinel-workbook incident-logging microsoft-sentinel-kql
-
Updated
Jun 2, 2026
Microsoft Sentinel cloud SIEM lab - deployed Azure VM, ingested Windows Security Events via AMA, wrote KQL queries to detect brute force attacks and failed logins in real time. Replicates L1 SOC analyst workflows.
azure incident-response cloud-security brute-force-detection microsoft-sentinel-kql siem-log-analytics windows-security-events
-
Updated
May 30, 2026
Microsoft Sentinel SOC lab using Azure Virtual Machines to investigate Windows Event ID 4625 authentication failures with KQL and identify suspicious IP activity.v
-
Updated
Jul 25, 2026
Improve this page
Add a description, image, and links to the microsoft-sentinel-kql topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the microsoft-sentinel-kql topic, visit your repo's landing page and select "manage topics."