AZURE-SIEM setup

###🔷 Practice for Blue Team 🔷##

Description

I setup Azure Sentinel (SIEM) and connect it to a live virtual machine acting as a honey pot. We observed live attacks (RDP Brute Force) from all around the world. We will use a custom PowerShell script to look up the attackers Geolocation information pulling the information from https://ipgeolocation.io/(with a dedicated key) and plot it on the Azure Sentinel Map!

Layout Example

Languages and Utilities Used

• Microsoft Azure
• Microsoft Sentinel
• PowerShell

Environments Used

• Mac OS & Windows 11
• Windows 10 Azure VM (21H2)

Walk-Through:

Set up Virtual machines - Windows 10 PRO Azure

Log to Pull users from Vm

RDP World Map - Login Failurs