Journal
Labs & ExperimentsDraft
Building a Microsoft Sentinel Lab to Learn KQL
Setting up a small, cost-conscious Sentinel workspace to practise Kusto Query Language against real sign-in data.
James Houlder1 min read
Draft. Planned lab — no results yet.
Lab goals
- Deploy a Log Analytics workspace with Sentinel
- Connect Entra ID sign-in logs
- Write and iterate on detection queries
Keeping costs sensible
Planned notes on data retention and ingestion limits.
A first query
SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType != 0
| summarize Failures = count() by UserPrincipalName, IPAddress
| order by Failures desc
What I want to learn
To be written.
- #sentinel
- #kql
- #azure
- #siem
Related articles
Open SourceDraft
DNS Daddy: Building an Open-Source Protective DNS Resolver
The thinking behind DNS Daddy — an open-source project exploring protective DNS and threat intelligence.
1 min
NetworkingDraft
Network Segmentation with pfSense and UniFi
Designing a segmented home-lab network with VLANs, firewall rules and sensible trust boundaries.
1 min
Cloud EngineeringDraft
Microsoft Entra ID: Understanding Identity and Access Management
A practical primer on how Entra ID models users, groups, roles and access — written while learning it properly.
1 min