First Cyber Security Project

For my first real hands on cyber security project, I decided to follow a guide on how to create a SIEM in Microsoft Azure.

I created a Windows 10 virtual machine and made it susceptible to the internet by turning almost all firewall options off in order to collect as much data as possible from possible attacks when the machine went live.

the next part was the most complicated. I created a custom PowerShell script to extract metadata from event viewer to be forwarded to a 3rd party API to derive geolocation data (the attackers location). I configured custom logs in Azures log analytics workspace to collect this geolocation data.

finally I configured Azure Sentinel to display global attack data through RDP brute force attempts on a map while also seeing the magnitude of the attack attempts

overall this was a fun first project despite being rather challenging due to my small experience with PowerShell however my understanding of Sentinel and SIEM’s in general helped get this one over the line.