building-cloud-siem-with-sentinel

# Building Cloud SIEM with Sentinel ## When to Use - When establishing a centralized security operations center for multi-cloud environments - When migrating from legacy SIEM platforms (Splunk, QRadar) to cloud-native architecture - When building automated incident response workflows for cloud-specific threats - When performing large-scale threat hunting across petabytes of security telemetry - When integrating threat intelligence feeds with cloud security log analysis **Do not use** for AWS-only environments where Security Hub and GuardDuty suffice, for endpoint detection requiring EDR capabilities (use Defender for Endpoint), or for compliance posture monitoring (see building-cloud-security-posture-management). ## Prerequisites - Azure subscription with Microsoft Sentinel enabled on a Log Analytics workspace - Data connector permissions for target log sources (AWS CloudTrail, Azure Activity, GCP) - Logic Apps or Azure Functions for automated response playbooks - KQL (Kusto Query Language) proficiency for writing detection rules and hunting queries ## Workflow ### Step 1: Provision Sentinel Workspace and Data Connectors Create a Log Analytics workspace optimized for security data and enable data connectors for multi-cloud ingestion. ```powershell # Create Log Analytics workspace az monitor log-analytics workspace create \ --resource-group security-rg \ --workspace-name sentinel-workspace \ --location eastus \ --retention-time 365 \ --sku PerGB2018 # Enabl...