Introducing This Project
Building on my risk tiered geo map, I turned the Critical tier into a live, scheduled Sentinel analytics rule. I mapped the Account and IP entities so every incident already shows who did it and from where, and tagged each alert with its MITRE ATT&CK technique. I set the rule to create one incident per Critical event and turned off alert grouping, so unrelated high risk changes don’t get bundled together before an analyst sees them.
Tools and Concepts
Microsoft Sentinel analytics rules, KQL, entity mapping, MITRE ATT&CK, incident grouping design, and taking detection logic from a workbook to a live rule.
Project Reflection
The map showed risky activity, but someone had to be looking at it. Turning it into a rule meant the same logic would alert on its own. When I tried to test the rule by assigning myself a limited role, the cyber range blocked the change, even on my own resources. That turned out to be a useful lesson: the environment applies least privilege even to small test actions, so I validated the rule through its query logic and configuration instead.