Project - Azure SIEM | Security Portfolio

Building a Cybersecurity Monitoring Simulation in Azure

As part of my hands-on journey into cybersecurity, I designed and implemented a cloud-based monitoring simulation using Microsoft Azure. The goal was to simulate a security operations center (SOC) environment, detect suspicious login behavior, and gain deeper insights into log analysis, SIEM systems, and cloud infrastructure. This project was both a personal challenge and a strategic stepping stone to build technical depth in Azure, Windows Server security, and threat detection workflows using Azure Sentinel.

Introduction

The core of the project consisted of the following components:

Microsoft Azure (Free Trial Account with $200 Credit)
Virtual Machine (AhsansVM – running Windows 11)
Azure Sentinel (SIEM solution to collect and analyze logs)
Azure Monitor Agent (Installed on AhsansVM for log forwarding)
Log Analytics Workspace (AhsansLogAnalytics – central data repository)
Custom Sentinel Analytics Rule (Detect successful RDP logins from non-system users)

System Architecture Overview

Steps

Azure Environment & Resource Group Setup

Created a free Microsoft Azure account to leverage the $200 credit for testing and building.

Set up a dedicated resource group: AhsansRG_ResourceGroup to keep all project components organized and easily manageable.

Virtual Machine Deployment (AhsansVM)

Compute Services: I navigated to the Azure portal's "Compute" section and selected "Virtual Machines".

Preset Configuration: For simplicity, I chose the "Preset configurations" option to quickly deploy a VM.

Resource Details: I specified the following details for the VM:
Resource Group: AhsanRG
Name: Should be AhsansVM, accidentally typed AhsansRG
Region: East US (You can choose a region closer to your location)
Operating System: Windows 11 Pro (This provides a robust operating system with built-in security features).
Size: I chose a small size to minimize costs during the trial.
Networking: The VM was automatically assigned a public IP address and network interface, allowing it to be accessed from the internet.

RDP Access: I ensured that RDP was enabled on port 3389 to allow remote management.

Azure Sentinel Deployment

Sentinel Creation: I navigated to the "Security" section and searched for "Sentinel". I then clicked "Create" to begin the deployment process.

Instance Configuration: I followed the guided steps to create a new Azure Sentinel instance.

Resource Group Association: I associated the Sentinel instance with the AhsansRG resource group.

Workspace Setup: I created a log analytics workspace called AhsansLogAnalytics. This workspace is where Sentinel stores the ingested security logs.

Region Consistency: I ensured that the Sentinel instance and the VM were in the same Azure region to minimize latency.

Azure Monitor Agent Installation

Agent Download and Installation: I downloaded the Azure Monitor Agent installation package from the Sentinel settings page.

Remote Management: I connected to the AhsansVM via RDP.

Agent Deployment: I executed the downloaded installer on the VM to install the Azure Monitor Agent.

Verification: After installation, I refreshed the Agents section in Sentinel to verify that the agent was successfully connected and sending logs.

Custom Sentinel Rule Development

Created a custom analytic rule in Sentinel to detect successful RDP logins by non-system accounts.

Rule Name: Successful-Local-Sign-ins

Severity: Initial Access

Frequency: Every 5 minutes

KQL Query used:

SecurityEvent
| where Activity contains "success" and Account !contains "system"

Alert Settings:
Case Type: “Art Case”
Incident Auto-Creation: Enabled

Grouping: Enabled to reduce noise and visualize clusters of alerts

Successfully deployed a simulated environment mimicking a small-scale SOC.
Azure Sentinel now receives real-time security events from AhsansVM.
The custom rule effectively identifies suspicious login behavior (non-system RDP logins).
Upon detection, alerts and incidents are automatically generated, providing a visual overview of potential threats within the Sentinel dashboard.

Results

Microsoft Azure (Cloud Infrastructure)
Azure Virtual Machines
Azure Sentinel (SIEM)
Azure Monitor Agent
Kusto Query Language (KQL)
Windows 11 Pro Virtual Machine

Tools and Technologies Used

🛠 Technical Skills Developed

Proficiency in Azure cloud architecture, including VM provisioning, resource grouping, and networking.
Gained practical knowledge of installing and configuring log forwarding tools (Azure Monitor Agent).
Wrote and tested security detection queries using KQL inside Sentinel.
Learned to tune and test analytics rules for real-time alerting.

📈 Security Understanding Enhanced

Deepened understanding of Windows Security Events, especially Event ID 4624 (logon success).
Gained insights into how RDP can be a vector for initial access in real-world cyberattacks.
Recognized the importance of excluding system accounts and refining rules to reduce false positives.

Key Lessons Learned

🔍 Enhance Threat Detection

Integrate threat intelligence feeds (e.g., Microsoft TI, AlienVault OTX) to enrich log data and detect known IOCs.

🤖 Automate Response Actions

Use Azure Logic Apps or playbooks to:
Auto-block IPs based on suspicious login attempts.
Isolate the VM from the network.
Notify administrators via Teams, SMS, or email.

🔧 Expand Monitoring Scope

Add file integrity monitoring (FIM) to watch for unauthorized file changes.
Implement network traffic analysis tools (e.g., Azure NSG flow logs).
Integrate additional VMs to simulate different roles (e.g., a web server or database server under attack).

🔧 Expand Monitoring Scope

Leverage Azure ML or Sentinel's built-in UEBA (User and Entity Behavior Analytics) to detect anomalies and patterns that indicate lateral movement or data exfiltration.

Future Enhancements & Expansion Ideas

This project marked a significant milestone in my cybersecurity journey. By building a security monitoring simulation in Azure from the ground up, I demonstrated my ability to plan, deploy, and manage a basic yet effective SIEM solution. It solidified my skills in cloud infrastructure, log analysis, detection engineering, and Windows security. More importantly, it showed me how theory translates into actionable detection in real environments.

I look forward to expanding this simulation into a more robust, scalable security lab that continuously challenges and enhances my capabilities as a future cybersecurity professional.

Building a Cybersecurity Monitoring Simulation in Azure

Introduction

The core of the project consisted of the following components:

System Architecture Overview

Steps

Results

Tools and Technologies Used

🛠 Technical Skills Developed

📈 Security Understanding Enhanced

Key Lessons Learned

🔍 Enhance Threat Detection

🤖 Automate Response Actions

🔧 Expand Monitoring Scope

🔧 Expand Monitoring Scope

Future Enhancements & Expansion Ideas

Conclusion