# Building Cloud Siem With Sentinel

> Deploy Microsoft Sentinel as a cloud-native SIEM and SOAR platform for Azure. Covers configuring data connectors (Entra ID, Azure Activity), writing KQL detection queries, and building automated response playbooks.

- Skill: `owasp/building-cloud-siem-with-sentinel` (Agent Skill)
- Install (CLI): `npx skillmds@latest add owasp/building-cloud-siem-with-sentinel`
- Raw SKILL.md: https://api.skillmd.com/api/skills/owasp/building-cloud-siem-with-sentinel/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: Apache-2.0
- Author: OWASP (https://skillmd.com/u/owasp)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/owasp/building-cloud-siem-with-sentinel

---


# Building Cloud SIEM with Sentinel — Azure Focused

## When to Use
- When establishing a centralized security operations center (SOC) for Azure.
- When building automated incident response workflows for Azure-specific threats.
- When performing threat hunting across Azure security telemetry using KQL.
- When integrating threat intelligence feeds with Azure Activity and Entra ID logs.

## Key Concepts

| Term | Definition |
|------|------------|
| KQL | Kusto Query Language, used for searching and analyzing data in Sentinel |
| Analytics Rule | Detection logic that creates incidents when specific conditions match |
| SOAR Playbook | Automated workflow triggered by incidents to perform response actions |
| Data Connector | Module that ingests security logs from Azure services into Sentinel |

## OpenShield Monitoring Rules

OpenShield identifies gaps in the logging required for an effective SIEM:
- **Logging**: `AZ-STOR-004` (Diagnostic Logs), `AZ-IDN-009` (Role Assignment Alerts)
- **Identity**: `AZ-IDN-007` (MFA Status), `AZ-IDN-002` (Conditional Access)

## SIEM Workflow

### Step 1: Provision Sentinel
Enable Microsoft Sentinel on a Log Analytics workspace.

### Step 2: Enable Connectors
Ingest Entra ID Sign-in/Audit logs and Azure Activity logs.

### Step 3: Write Detection Queries
Example: Detect impossible travel or mass resource deletions.

### Step 4: Automate Response
Use Logic Apps to automatically disable compromised Entra ID accounts.

## Remediation Reference
- **Enable Diagnostic Settings**: Ensure all critical resources send logs to the Sentinel workspace.
- **Use Fusion Rules**: Enable Sentinel's multi-stage attack detection (Fusion) for high-fidelity alerts.
- **Automate Remediation**: Link OpenShield findings to Sentinel incidents for automated response.