Introducing This Project
I built a Microsoft Sentinel workbook that maps where Azure administrative changes are coming from and scores each one by how dangerous it is. Instead of treating every change the same, I sorted operations into risk tiers: role assignments and deleted alert rules are Critical, firewall and Key Vault changes are High, and routine changes are left off the map. Bubble size reflects risk, not volume, so a single Critical change from an unfamiliar location stands out more than hundreds of routine deployments.
Tools and Concepts
Microsoft Sentinel workbooks, KQL, AzureActivity logs, risk based classification, IP geolocation, and data visualization.
Project Reflection
The biggest lesson was that the map wasn’t the hard part. Deciding which operations belong in which tier was the real work, because that decision controls what an analyst notices first. I also learned that IP location can be misleading, since attackers often use VPNs or cloud hosting, so the map is a starting point for investigation, not proof of where someone is.