SIEM (Security Information and Event Management)
  → Collects logs from everything
  → Correlates events across sources
  → Detects threats using rules + AI
  → Surfaces alerts and incidents
SOAR (Security Orchestration, Automation and Response)
  → Automates response to detected threats
  → Runs playbooks (Logic Apps) automatically
  → Integrates with ticketing, ITSM, and remediation tools
  → Reduces mean time to respond (MTTR)
Sentinel = both in one service, built on Log Analytics

Windows VMs → Log Analytics Agent → SecurityEvent table
Linux VMs   → Syslog → Syslog table
Network devices → CEF → AMA agent → CommonSecurityLog table

// Detect impossible travel — same user, two countries, <1 hour apart
let threshold_minutes = 60;
SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType == 0  // successful sign-in
| project TimeGenerated, UserPrincipalName,
          Location, IPAddress,
          Latitude = toreal(LocationDetails.geoCoordinates.latitude),
          Longitude = toreal(LocationDetails.geoCoordinates.longitude)
| sort by UserPrincipalName, TimeGenerated asc
| extend PrevLocation = prev(Location, 1),
         PrevTime = prev(TimeGenerated, 1),
         PrevUser = prev(UserPrincipalName, 1)
| where UserPrincipalName == PrevUser
| extend TimeDiff = datetime_diff('minute', TimeGenerated, PrevTime)
| where TimeDiff < threshold_minutes
| where Location != PrevLocation
| project UserPrincipalName, Location, PrevLocation,
          TimeDiff, IPAddress, TimeGenerated

// Detect Azure Firewall blocking connections to known malicious IPs
AzureDiagnostics
| where Category == "AzureFirewallNetworkRule"
| where msg_s has "Deny"
| parse msg_s with * "from " SourceIP ":" SourcePort
    " to " DestIP ":" DestPort ". Action: " Action
| join kind=inner (
    ThreatIntelligenceIndicator
    | where Active == true
    | project NetworkIP, ThreatType, ConfidenceScore
) on $left.DestIP == $right.NetworkIP
| project TimeGenerated, SourceIP, DestIP, ThreatType, ConfidenceScore

Signal 1: Entra ID — suspicious sign-in from anonymising proxy
Signal 2: Office 365 — mass email forwarding rule created
Signal 3: Azure — new service principal with owner role
Individual signals: low severity, easy to miss
Fusion correlation: HIGH severity — likely BEC (Business Email Compromise) attack

Incident: Possible BEC attack — john.smith@contoso.com
  Severity: High
  Status:   New
  Assigned: SOC Analyst 2
  Alerts:
    ├── Impossible travel detected (Entra ID)
    ├── Mass forwarding rule created (Office 365)
    └── New privileged service principal (Azure Activity)
  Entities:
    ├── User: john.smith@contoso.com
    ├── IP: 185.220.101.45 (Tor exit node)
    └── Host: LAPTOP-JSmith
  MITRE ATT&CK:
    ├── T1078 — Valid accounts
    ├── T1114 — Email collection
    └── T1098 — Account manipulation

185.220.101.45 (Tor IP)
        ↓ signed in as
john.smith@contoso.com (user)
        ↓ created
Forward-all-mail rule (Office 365)
        ↓ same session created
sp-finance-automation (service principal)
        ↓ granted
Owner role on subscription

User: john.smith@contoso.com
  Last 90 days:
  ├── Sign-ins: 847 (normal pattern: Mon-Fri 8am-6pm EST)
  ├── Anomalous sign-ins: 3 (Tor, Russia, Ukraine)
  ├── Files accessed: 12,847
  ├── Emails sent: 2,341
  ├── Azure resource operations: 156
  └── Risk score: 94/100 (UEBA)

Trigger: Sentinel incident created
  Condition: Severity == High AND Entity type == User
Actions:
  1. Get user details from Entra ID
  2. Disable user account in Entra ID
  3. Revoke all active sessions (MFA re-auth required)
  4. Send Teams message to SOC channel:
     "User john.smith auto-disabled — incident #1234"
  5. Create ServiceNow ticket with incident details
  6. Add comment to Sentinel incident:
     "User account disabled at 14:32 UTC by playbook"

Trigger: Sentinel incident created
  Condition: Severity == High AND Entity type == Host
Actions:
  1. Get VM resource ID from entity
  2. Apply isolation NSG (deny all inbound + outbound except Bastion)
     az network nsg rule create --name ISOLATE --priority 100
       --access Deny --direction Inbound --source-address-prefix *
  3. Take VM disk snapshot (forensic preservation)
  4. Tag VM: {"Status": "Isolated", "IncidentId": "1234"}
  5. Notify SOC team via email + Teams
  6. Create Jira ticket for IR team

Trigger: Sentinel alert contains IP entity
Actions:
  1. Query VirusTotal API for IP reputation
  2. Query Shodan for open ports and services
  3. Query AbuseIPDB for abuse reports
  4. Add enrichment comment to incident:
     "IP 185.220.101.45:
      VirusTotal: 47/92 vendors flagged malicious
      AbuseIPDB: 847 reports, 100% confidence malicious
      Shodan: Tor exit node — AS16276 OVH"
  5. If malicious score > 80:
     → Add IP to Azure Firewall deny list automatically

// Find all failed logins followed by success from same IP
// (credential stuffing pattern)
let failed_logins = SigninLogs
    | where TimeGenerated > ago(1h)
    | where ResultType != 0  // failed
    | summarize FailCount = count() by IPAddress, UserPrincipalName
    | where FailCount > 10;
let successful_logins = SigninLogs
    | where TimeGenerated > ago(1h)
    | where ResultType == 0  // success
    | project IPAddress, UserPrincipalName, SuccessTime = TimeGenerated;
successful_logins
| join kind=inner failed_logins on IPAddress
| project IPAddress, UserPrincipalName,
          FailCount, SuccessTime
| order by FailCount desc

// Detect Azure privilege escalation — new owner role assignment
AzureActivity
| where TimeGenerated > ago(1d)
| where OperationNameValue == "MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE"
| where ActivityStatusValue == "Success"
| extend RoleDefinitionId = tostring(
    parse_json(Properties).requestbody.properties.roleDefinitionId)
| where RoleDefinitionId contains "8e3af657-a8ff-443c-a75c-2fe8c4bcb635"  // Owner
| project TimeGenerated, Caller, ResourceGroup,
          SubscriptionId, RoleDefinitionId

// Hunt for lateral movement via PsExec or WMI
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID in (4688, 4624)  // process create + logon
| where ProcessName has_any ("psexec", "wmic", "winrm")
    or CommandLine has_any ("\\\\", "invoke-wmimethod", "wmiexec")
| summarize count() by Computer, Account, ProcessName, CommandLine
| order by count_ desc

Microsoft Sentinel (Log Analytics Workspace)
         ↑
         │ data connectors
    ┌────┴──────────────────────────────────┐
    │                                       │
Hub VNet                             Spoke VNets
 Azure Firewall logs                  AKS/ARO audit logs
 VPN Gateway logs                     VM security events
 Bastion session logs                 NSG flow logs
 DNS resolver logs                    App Gateway WAF logs
    │
On-premises (via MMA/AMA agent)
 Windows Security Events
 Linux Syslog
 Network device CEF