Microsoft Sentinel cloud SIEM lab - deployed Azure VM, ingested Windows Security Events via AMA, wrote KQL queries to detect brute force attacks and failed logins in real time. Replicates L1 SOC analyst workflows.

A Microsoft Sentinel SOC homelab in Azure, where I built and validated a basic cloud SOC workflow: data onboarding, detection, investigation, and visualization. It demonstrates practical blue-team skills in SIEM operations, KQL-based threat hunting, watchlist enrichment, and workbook reporting.