Dee’sCYBER CORNER
Back to the project overview

Cloud security / Lab walkthrough

Deploy my cloud
security monitoring lab.

Set up the foundation of cloud security visibility: a Log Analytics workspace for centralized logs and Microsoft Sentinel on top of it.

Microsoft AzureMicrosoft SentinelLog AnalyticsKQL

Why I built this lab

You can’t protect what you can’t see. I built this to understand the foundation every cloud security program starts with: getting logs into one place so activity can be monitored, investigated, and audited.

Make it your own. This is how I did it, not the only way. Feel free to adjust the lab to your liking: change the names, tools, or scope, or take it further. What matters is that you understand what you built and why.

Before you start

  • An Azure subscription you can create resources in. I practiced with the TryHackMe SentinelDeploy lab.
  • Permission to create a resource group, a Log Analytics workspace, and Microsoft Sentinel.

What you’ll learn

  • How a Log Analytics workspace centralizes security logs
  • Deploying Microsoft Sentinel on a workspace
  • Exploring data connectors and monitoring capabilities
  • Why centralized logging matters for audit readiness and governance

How it fits together

  1. Resource groupOne container for everything in the lab.
  2. Log Analytics workspaceWhere logs are collected and stored.
  3. Microsoft SentinelSIEM features added to the workspace.
  4. Data connectorsSources that send logs in.
  5. Logs + KQLConfirm data and start investigating.

Step by step

  1. Create a resource group

    In the Azure portal, create a resource group for the lab, in the region you plan to use for everything else.

  2. Create the Log Analytics workspace

    Search for Log Analytics workspaces and create one in your resource group and region. This is the centralized logging foundation that Sentinel sits on.

  3. Add Microsoft Sentinel

    Search for Microsoft Sentinel, select Create, choose your workspace, and add Sentinel to it. When it finishes, open Sentinel from the portal to confirm the deployment.

  4. Review data connectors

    Open Data connectors (and the Content hub, where connector solutions are installed). Review what each connector collects and how it supports monitoring.

    For a simple first source, install and connect Azure Activity, which records actions taken on your subscription.

  5. Confirm logs are arriving

    Open Logs in the workspace and run a quick query. New data can take a little while to appear.

    kql
    AzureActivity
| take 10

  6. Document it

    Write down your deployment steps, settings, and screenshots. Note how centralized logging supports accountability, audit readiness, and future incident investigation.

Check your work

Clean up

Sentinel and Log Analytics bill based on the data you ingest, so delete the lab’s resource group when you finish.

Interview ready

Be ready to explain

  • What a Log Analytics workspace is, and why Sentinel needs one.
  • Why centralized logging is a foundational control for audit readiness.
  • How the data connectors you enabled support future detection and investigation.
  • How this foundation leads into detections, like my Azure honeypot lab.

Know your work front to back and you’ll be ready when someone says “walk me through it.”

This walkthrough follows my lab. Portals and menus change over time, so names may look slightly different when you try it. See my original write-up on GitHub

Back to the project overview