{"id":1260,"date":"2026-11-01T07:03:35","date_gmt":"2026-11-01T07:03:35","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/?p=1260"},"modified":"2026-11-01T07:07:19","modified_gmt":"2026-11-01T07:07:19","slug":"microsoft-sentinel-foundations-one-complete-end-to-end-hands-on-lab","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/microsoft-sentinel-foundations-one-complete-end-to-end-hands-on-lab\/","title":{"rendered":"Microsoft Sentinel Foundations: One Complete End-to-End Hands-On Lab – Part – 1"},"content":{"rendered":"\n

Student workbook + instructor validation and answer key | Days 1-2 | 2026-11-01 edition<\/strong><\/p>\n\n\n\n

\n

One lab, one continuous story:<\/strong> Build a Microsoft Sentinel environment, connect Azure Activity logs, make a harmless Azure configuration change, prove that the event reaches the AzureActivity<\/code> table, investigate it using KQL, turn a tested query into a temporary scheduled detection, find its actual alert and incident, complete a first-line SOC triage record, visualize the data with a workbook, and clean up safely.<\/p>\n\n\n\n

Primary interface:<\/strong> Microsoft Defender portal (https:\/\/security.microsoft.com<\/code>), with Azure portal (https:\/\/portal.azure.com<\/code>) for initial Azure resources and subscription-level activity-log configuration. This matches Microsoft’s current direction for Sentinel. [MS01] [MS02]<\/p>\n\n\n\n

This is a Foundation lab, not a red-team exercise.<\/strong> Do not attack resources, intentionally compromise identities, turn on disruptive automations, export real secrets, or run changes in production. Never equate a saved rule or KQL simulation with a genuine alert or incident.<\/strong><\/p>\n<\/blockquote>\n\n\n\n

\n\n\n\n

1. The outcome: what a successful student can demonstrate<\/h2>\n\n\n\n

At the end, you should be able to show evidence<\/em>, not simply explain terminology:<\/p>\n\n\n\n

    \n
  1. A named, approved Azure subscription and its access boundaries.<\/li>\n\n\n\n
  2. A Log Analytics workspace with Microsoft Sentinel enabled and visible in the Defender portal.<\/li>\n\n\n\n
  3. The Azure Activity solution and a documented, working route from the source subscription to that workspace.<\/li>\n\n\n\n
  4. A harmless resource-group write visible in the\u00a0source Azure Activity log<\/strong>\u00a0and in the\u00a0destination\u00a0AzureActivity<\/code>\u00a0table<\/strong>.<\/li>\n\n\n\n
  5. A working KQL query that isolates the test event, displays a timestamp and identifies the actor\/resource.<\/li>\n\n\n\n
  6. A temporary enabled scheduled analytics rule with verified settings and minimal alert noise.<\/li>\n\n\n\n
  7. A\u00a0real generated alert<\/strong>\u00a0and a\u00a0real incident<\/strong>\u00a0containing that alert (or clearly recorded environment blocker).<\/li>\n\n\n\n
  8. An incident investigation report with disposition, evidence, owner, and escalation rationale.<\/li>\n\n\n\n
  9. A relevant Azure Activity workbook interpreted correctly.<\/li>\n\n\n\n
  10. Cleanup evidence showing that the test rule is disabled\/removed and lab resources are handled safely.<\/li>\n<\/ol>\n\n\n\n

    Foundation qualification:<\/strong> Complete the entire evidence chain and meet the rubric in Section 16. Installing Sentinel or obtaining a screenshot of the portal alone does not<\/strong> constitute a pass.<\/p>\n\n\n\n

    Where this lab fits in the five-day program<\/h3>\n\n\n\n
    Previous teaching<\/th>This continuous workflow practices<\/th>Reserved for later days<\/th><\/tr><\/thead>
    F01-F12, Day 1<\/td>SOC context, architecture, roles, workspace, data connector<\/td>Advanced source onboarding and DCRs (Day 3)<\/td><\/tr>
    F13-F23, Day 2<\/td>KQL, content, rule, alert, incident, triage, workbook, troubleshooting<\/td>Multi-table correlation\/UEBA (Day 3); ASIM\/SOAR (Day 4); enterprise CI\/CD\/data lake (Day 5)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    This manual intentionally uses one connected exercise<\/strong>, instead of repeating the 17 individual practice labs in the more detailed Day 1-2 workbook.<\/p>\n\n\n\n

    \n\n\n\n

    2. 5W1H: understand what you will build before clicking<\/h2>\n\n\n\n
    Question<\/th>Foundation-level answer<\/th><\/tr><\/thead>
    What?<\/strong><\/td>Microsoft Sentinel is a SIEM capability that collects security telemetry and supports detection, investigation, and response.<\/td><\/tr>
    Why?<\/strong><\/td>An isolated activity record is difficult for a SOC to investigate consistently; centralized logs, rules, and incidents create a repeatable trail.<\/td><\/tr>
    Who?<\/strong><\/td>The Azure\/platform administrator authorizes data collection; the security engineer configures Sentinel; the SOC analyst investigates alerts; the instructor approves training changes.<\/td><\/tr>
    When?<\/strong><\/td>Use the workflow when an approved activity needs visibility, detection, triage, and documented resolution.<\/td><\/tr>
    Where?<\/strong><\/td>Azure control-plane events originate in the subscription, flow to a Log Analytics workspace, and are examined in Microsoft Sentinel through the Defender portal.<\/td><\/tr>
    How?<\/strong><\/td>Source event -> approved diagnostic export\/policy -> AzureActivity<\/code> -> KQL -> scheduled analytics rule -> alert -> Defender incident -> SOC triage -> workbook.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    The architecture you will prove<\/h3>\n\n\n\n
    Approved student action: change a tag on a test resource groupAzure subscription Activity logAzure Activity connector configuration: policy or diagnostic exportLog Analytics workspace: AzureActivity tableMicrosoft Sentinel analytics rule: scheduled KQLSecurity alertMicrosoft Defender incident queueAnalyst triage, evidence, classificationAzure Activity workbook<\/pre>\n\n\n\n
    Important boundaries:<\/strong> Creating a resource-group tag is not a cyberattack. For this lab, the detection identifies authorized training activity<\/em> and must be labeled as such; it must never<\/strong> be marketed as a high-fidelity threat detection. A scheduled rule may raise an alert without proving an actual security incident.<\/p>\n\n\n\n
    \n\n\n\n
    3. Choose a delivery mode and establish safety controls<\/h2>\n\n\n\n
    3.1 Three supported classroom modes<\/h3>\n\n\n\n
    Mode<\/th>What the instructor prepares<\/th>What the learner can pass<\/th><\/tr><\/thead>
    A – Full build (preferred)<\/strong><\/td>Dedicated non-production Azure subscription or approved sandbox, rights to provision workspace, export subscription activity, and configure Sentinel<\/td>All ten outcomes<\/td><\/tr>
    B – Instructor-managed collection<\/strong><\/td>Prebuilt Sentinel workspace and Azure Activity export; learner may edit a dedicated signal resource group and create a temporary rule<\/td>End-to-end event-to-incident workflow without repeating administrative provisioning<\/td><\/tr>
    C – Read-only \/ offline<\/strong><\/td>Screenshots and synthetic datatable()<\/code> examples, optionally a read-only Sentinel workspace<\/td>Concepts and KQL only; cannot<\/strong> claim to have created a real alert or incident<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    If an approval, permission, subscription, billing entitlement, or data-collection requirement fails, select Mode B or C and label the blocked checkpoint. Do not<\/strong> grant students broad permissions only to make a lab appear successful.<\/p>\n\n\n\n
    3.2 Minimum preparation and role separation<\/h3>\n\n\n\n
    Activity<\/th>Typical required access or approval<\/th>Responsible party<\/th><\/tr><\/thead>
    Create a resource group \/ workspace<\/td>Azure subscription or resource-group write permission; enabling Sentinel requires subscription Contributor-equivalent permission<\/td>Instructor\/platform admin<\/td><\/tr>
    Use Sentinel and view logs<\/td>Microsoft Sentinel Reader or appropriate Log Analytics read permissions<\/td>Student or instructor<\/td><\/tr>
    Install Content hub solution \/ author analytics rule<\/td>Microsoft Sentinel Contributor on workspace resource group<\/td>Instructor\/security engineer or delegated student<\/td><\/tr>
    Manage the incident<\/td>Microsoft Sentinel Responder (or Contributor) and any relevant Defender unified incident permissions<\/td>SOC student<\/td><\/tr>
    Configure Azure Activity export<\/td>Subscription-level diagnostic setting or Azure Policy assignment permission; assignment\/managed-identity remediation may need additional rights<\/td>Subscription\/policy owner<\/td><\/tr>
    Use or save workbooks<\/td>Workbook Reader \/ Workbook Contributor and relevant Sentinel rights<\/td>Student\/instructor<\/td><\/tr>
    Connect workspace to Defender if not already connected<\/td>Additional onboarding permission requirements in Microsoft documentation; instructor should perform it if not already onboarded<\/td>Tenant\/subscription administrator<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    Microsoft’s permissions are task-specific.<\/strong> A Sentinel Contributor assignment does not automatically authorize every subscription-level Azure Policy change, and a Sentinel Reader cannot manage incidents. Review the exact role scope before starting. [MS01] [MS03] [MS04]<\/p>\n\n\n\n
    3.3 Preflight requirements – instructor checks<\/h3>\n\n\n\n
      \n
    • [ ] A\u00a0non-production<\/strong>\u00a0training subscription exists; its subscription ID, tenant, and billing owner are documented.<\/li>\n\n\n\n
    • [ ] There is an approved Azure region and naming pattern; no sensitive customer data is needed.<\/li>\n\n\n\n
    • [ ] Learner identities have approved scopes, not unnecessarily broad Owner rights.<\/li>\n\n\n\n
    • [ ] The instructor has a plan for Azure Activity export:\u00a0existing approved export<\/strong>,\u00a0Azure Policy wizard<\/strong>, or\u00a0direct subscription diagnostic setting<\/strong>. Avoid creating duplicate exports of the same categories to the same workspace.<\/li>\n\n\n\n
    • [ ] The sandbox has approval for potential Sentinel\/Log Analytics and other service charges. Azure Activity ingestion has specific no-ingestion-charge guidance, but this does\u00a0not<\/strong>\u00a0mean every Sentinel or lab component is free. Confirm pricing for the selected plan. [MS05] [MS06]<\/li>\n\n\n\n
    • [ ] The instructor has confirmed which incident experience is available:\u00a0Incidents<\/strong>\u00a0or the preview\u00a0Cases > Incident<\/strong>. [MS10] [MS11]<\/li>\n\n\n\n
    • [ ] The instructor has approved cleanup ownership and whether the lab workspace will be retained for subsequent training.<\/li>\n<\/ul>\n\n\n\n
      Safety stop:<\/strong> If any requested change affects a shared production diagnostic setting, permission assignment, data-retention policy, or real customer incident, do not perform that step<\/strong>. Ask the instructor to complete it or provide a safe sandbox artifact.<\/p>\n\n\n\n
      3.4 Student fill-in sheet – use actual values<\/h3>\n\n\n\n
      Parameter<\/th>Your value<\/th><\/tr><\/thead>
      Cohort and student ID<\/td>________________<\/code><\/td><\/tr>
      Training tenant\/domain (non-sensitive label)<\/td>________________<\/code><\/td><\/tr>
      Approved subscription ID<\/td>________________<\/code><\/td><\/tr>
      Workspace resource group<\/td>rg-sentinel-foundation-________<\/code><\/td><\/tr>
      Log Analytics workspace<\/td>law-sentinel-foundation-________<\/code><\/td><\/tr>
      Workspace region<\/td>________________<\/code><\/td><\/tr>
      Approved signal resource group<\/td>rg-sentinel-signal-________<\/code><\/td><\/tr>
      Activity-export method<\/td>Existing \/ Azure Policy \/ Diagnostic setting<\/td><\/tr>
      Activity-export policy or setting name<\/td>________________<\/code><\/td><\/tr>
      Detection rule name<\/td>LAB-FOUNDATION-________-RG-WRITE<\/code><\/td><\/tr>
      Student’s incident owner\/assigned analyst<\/td>________________<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
      Naming: replace the underscores with a short unique<\/strong>, cloud-valid suffix. Use the same exact names<\/strong> in screenshots and queries. Do not type the placeholder values unchanged into production.<\/p>\n\n\n\n
      \n\n\n\n
      DAY 1 – Build and prove the telemetry path<\/h1>\n\n\n\n
      Phase 1 – Verify the subscription and the lab scope<\/h2>\n\n\n\n
      Goal:<\/strong> Know where you are and what you may change.<\/p>\n\n\n\n
        \n
      1. Sign in to\u00a0https:\/\/portal.azure.com<\/code>\u00a0with the instructor-approved user.<\/li>\n\n\n\n
      2. Search for\u00a0Subscriptions<\/strong>. Open the subscription authorized for this lab.<\/li>\n\n\n\n
      3. Copy the\u00a0Subscription ID<\/strong>\u00a0into the student sheet. Record its display name without exposing unnecessary organizational details.<\/li>\n\n\n\n
      4. Confirm the selected\u00a0Directory + subscription<\/strong>\u00a0filter shows the intended tenant\/subscription. If multiple subscriptions are visible, switch to the approved one.<\/li>\n\n\n\n
      5. In\u00a0Access control (IAM)<\/strong>, ask the instructor to verify that your assignment permits the operations you will perform. Do not try random role changes to fix permission failures.<\/li>\n\n\n\n
      6. Agree on the approved region, the workspace RG, and a\u00a0different<\/strong>\u00a0resource group used to generate test activity.<\/li>\n\n\n\n
      7. In\u00a0Cost Management + Billing<\/strong>\u00a0or the instructor’s approved budget view, record the allowed lab spend and who will review it.<\/li>\n<\/ol>\n\n\n\n
        PASS checkpoint P01:<\/strong> Correct subscription\/tenant, permissions, workspace location, and a cost\/cleanup owner recorded. Save P01-subscription-scope.png<\/code> (hide subscription IDs if materials will be shared externally).<\/p>\n\n\n\n
        Why it matters:<\/strong> A valid query against the wrong tenant or workspace can return nothing. A subscription-scope export configured against the wrong subscription cannot transport your test event.<\/p>\n\n\n\n
        Phase 2 – Create or verify a Log Analytics workspace<\/h2>\n\n\n\n
        If the instructor supplied a workspace:<\/strong> Open it, confirm its subscription, resource group and region, and go to Phase 3. Do not create a duplicate.<\/p>\n\n\n\n
        Full-build route:<\/strong><\/p>\n\n\n\n
          \n
        1. In Azure portal search for\u00a0Log Analytics workspaces<\/strong>\u00a0and select\u00a0Create<\/strong>.<\/li>\n\n\n\n
        2. Select the approved\u00a0subscription<\/strong>.<\/li>\n\n\n\n
        3. Select the designated workspace resource group, or\u00a0Create new<\/strong>\u00a0if authorized.<\/li>\n\n\n\n
        4. Enter your unique\u00a0workspace name<\/strong>\u00a0such as\u00a0law-sentinel-foundation-s01<\/code>.<\/li>\n\n\n\n
        5. Select the instructor-approved\u00a0region<\/strong>; do not guess a region merely because it appears in a sample screenshot.<\/li>\n\n\n\n
        6. Review pricing, data residency and retention implications. Do not activate optional products or unapproved long-term retention.<\/li>\n\n\n\n
        7. Select\u00a0Review + Create<\/strong>, wait for validation, then\u00a0Create<\/strong>.<\/li>\n\n\n\n
        8. Open the workspace. Record\u00a0Name<\/strong>,\u00a0Resource group<\/strong>,\u00a0Region<\/strong>, and\u00a0Subscription<\/strong>\u00a0from the Overview screen.<\/li>\n\n\n\n
        9. Check whether Sentinel was already enabled on it. If yes, record and continue; do not try to onboard the same workspace twice.<\/li>\n<\/ol>\n\n\n\n
          PASS P02:<\/strong> The exact intended Log Analytics workspace exists, is accessible, and its metadata is recorded. Save P02-workspace-overview.png<\/code>.<\/p>\n\n\n\n
          Common problem:<\/strong> The workspace does not appear in the Sentinel onboarding picker. Check subscription filter, workspace eligibility and permissions; default Defender for Cloud workspaces have restrictions for Sentinel onboarding. [MS01]<\/p>\n\n\n\n
          Phase 3 – Enable Microsoft Sentinel and confirm Defender portal visibility<\/h2>\n\n\n\n
            \n
          1. In\u00a0Azure portal<\/strong>, search for\u00a0Microsoft Sentinel<\/strong>.<\/li>\n\n\n\n
          2. Choose\u00a0Create<\/strong>, select the intended\u00a0Log Analytics workspace<\/strong>, and choose\u00a0Add<\/strong>. If Sentinel is already enabled,\u00a0do not repeat<\/strong>\u00a0the action.<\/li>\n\n\n\n
          3. Open\u00a0https:\/\/security.microsoft.com<\/code>\u00a0and let initial portal provisioning finish if prompted.<\/li>\n\n\n\n
          4. Expand\u00a0Microsoft Sentinel<\/strong>\u00a0in the navigation. Confirm the workspace is available under\u00a0System \/ Settings > Microsoft Sentinel > Workspaces<\/strong>\u00a0(exact menu grouping may vary).<\/li>\n\n\n\n
          5. If no workspace is connected, have the instructor\/onboarding owner follow\u00a0Settings > Microsoft Sentinel > Connect a workspace<\/strong>, select the appropriate workspace and primary workspace, review the connection effects, then\u00a0Connect<\/strong>. This is not a task for a student lacking onboarding rights. [MS02]<\/li>\n\n\n\n
          6. Record whether this tenant uses a standard incident queue or incident-cases preview. Do not enable preview features just to match this manual.<\/li>\n\n\n\n
          7. Confirm you can access\u00a0Microsoft Sentinel > Configuration > Data connectors<\/strong>,\u00a0Configuration > Analytics<\/strong>, and the hunting\/logs query interface, even if some operations are read-only.<\/li>\n<\/ol>\n\n\n\n
            PASS P03:<\/strong> You can point to the correct Sentinel-enabled workspace<\/strong> from the Defender portal, and your access level is known. Save P03-defender-workspace.png<\/code>.<\/p>\n\n\n\n
            Know the distinction:<\/strong> Log Analytics<\/strong> is the data\/query workspace; Sentinel<\/strong> adds SIEM capabilities; Defender portal<\/strong> is the current unified analyst experience. A workspace being created does not itself prove that it is receiving activity logs. [MS01] [MS02]<\/p>\n\n\n\n
            Phase 4 – Install the Azure Activity content and configure an export route<\/h2>\n\n\n\n
            Step A – Content hub<\/h3>\n\n\n\n
              \n
            1. In Defender portal expand\u00a0Microsoft Sentinel<\/strong>\u00a0and open\u00a0Content hub<\/strong>\u00a0(use portal search if your navigation differs).<\/li>\n\n\n\n
            2. Search for\u00a0Azure Activity<\/strong>.<\/li>\n\n\n\n
            3. Open the solution, review its connectors\/rule templates\/workbooks and dependencies.<\/li>\n\n\n\n
            4. Select\u00a0Install<\/strong>\u00a0if not already installed. Wait for it to show as installed.<\/li>\n\n\n\n
            5. Open\u00a0Microsoft Sentinel > Configuration > Data connectors<\/strong>.<\/li>\n\n\n\n
            6. Find\u00a0Azure Activity<\/strong>, then\u00a0Open connector page<\/strong>.<\/li>\n\n\n\n
            7. Read its prerequisites, data type (AzureActivity<\/code>) and configuration status.\u00a0Connected<\/strong>\u00a0is useful information but not proof of a particular event reaching the table.<\/li>\n<\/ol>\n\n\n\n
              Step B – Choose exactly one approved export method<\/h3>\n\n\n\n
              Method 1 – existing instructor-approved export (best for shared classrooms):<\/strong><\/p>\n\n\n\n
                \n
              1. In Azure portal open the approved\u00a0subscription > Activity log > Export Activity Logs<\/strong>, or have the admin show its relevant Azure Policy assignment.<\/li>\n\n\n\n
              2. Confirm Administrative events (at minimum) are sent to the\u00a0correct<\/strong>\u00a0Log Analytics workspace.<\/li>\n\n\n\n
              3. Record the existing setting\/policy name, destination workspace and owner. Do not modify it.<\/li>\n<\/ol>\n\n\n\n
                Method 2 – Azure Activity connector’s Azure Policy wizard (Microsoft quickstart route):<\/strong><\/p>\n\n\n\n
                  \n
                1. From\u00a0Azure Activity > Open connector page<\/strong>, select\u00a0Launch Azure Policy Assignment Wizard<\/strong>.<\/li>\n\n\n\n
                2. Under\u00a0Basics<\/strong>, choose only the instructor-approved subscription scope; do not select an entire management group or unrelated subscriptions.<\/li>\n\n\n\n
                3. Under\u00a0Parameters<\/strong>, choose the\u00a0Primary Log Analytics workspace<\/strong>\u00a0that contains your Sentinel instance.<\/li>\n\n\n\n
                4. With the policy owner, review the policy effect, assigned identity (if presented), permissions\/remediation requirements, and target subscription. Resolve permission failures with the owner, not elevated student privileges.<\/li>\n\n\n\n
                5. Select\u00a0Review + create > Create<\/strong>\u00a0after explicit approval.<\/li>\n\n\n\n
                6. Record the assignment identifier and review it under\u00a0Azure Policy > Assignments<\/strong>. Allow time for the policy\/diagnostic configuration to take effect. [MS01]<\/li>\n<\/ol>\n\n\n\n
                  Method 3 – direct subscription diagnostic setting (only when approved):<\/strong><\/p>\n\n\n\n
                    \n
                  1. In Azure portal open\u00a0Monitor > Activity log > Export Activity Logs<\/strong>\u00a0for your approved subscription.<\/li>\n\n\n\n
                  2. Select\u00a0Add diagnostic setting<\/strong>.<\/li>\n\n\n\n
                  3. Name it clearly, for example\u00a0diag-sentinel-foundation-s01<\/code>.<\/li>\n\n\n\n
                  4. Select the\u00a0Administrative<\/strong>\u00a0category. Add other categories only if they are approved for the lab.<\/li>\n\n\n\n
                  5. Under\u00a0Destination details<\/strong>, choose\u00a0Send to Log Analytics workspace<\/strong>, then the approved subscription and workspace.<\/li>\n\n\n\n
                  6. Verify all four before saving:\u00a0source subscription, categories, destination workspace, setting name<\/strong>.<\/li>\n\n\n\n
                  7. Select\u00a0Save<\/strong>, record the name, and check that you have not introduced a duplicate route. [MS05] [MS06]<\/li>\n<\/ol>\n\n\n\n
                    Do not configure Methods 2 and 3 in parallel for the same source\/destination unless the instructor deliberately designed that topology.<\/strong><\/p>\n\n\n\n
                    PASS P04:<\/strong> Azure Activity solution present; documented export configuration targets the correct workspace; Administrative category is covered; owner and cleanup responsibility recorded. Save P04-activity-connector.png<\/code> and, if authorized, an export configuration screenshot.<\/p>\n\n\n\n
                    What you have and have not proved<\/h3>\n\n\n\n
                      \n
                    • You have verified the\u00a0configuration<\/strong>\u00a0of collection.<\/li>\n\n\n\n
                    • You have\u00a0not<\/strong>\u00a0yet proved that an actual event traveled through it. That happens in Phase 5.<\/li>\n<\/ul>\n\n\n\n
                      Phase 5 – Produce a harmless, traceable event<\/h2>\n\n\n\n
                      Scenario:<\/strong> Aster Retail (fictional company) is validating whether SOC analysts can see Azure administrative changes. You are a platform engineer making an approved change to a sandbox resource group. The SOC should observe and explain it.<\/p>\n\n\n\n
                        \n
                      1. In Azure portal, go to\u00a0Resource groups > Create<\/strong>.<\/li>\n\n\n\n
                      2. Create a\u00a0new, empty<\/strong>\u00a0group named with your approved signal identifier, such as\u00a0rg-sentinel-signal-s01<\/code>, in the approved subscription and region. Keep it empty; do\u00a0not<\/strong>\u00a0deploy VMs, storage accounts or paid services.<\/li>\n\n\n\n
                      3. After creation, open that resource group and select\u00a0Tags<\/strong>.<\/li>\n\n\n\n
                      4. Add a harmless tag:\u00a0Name<\/strong>\u00a0sentinelTraining<\/code>;\u00a0Value<\/strong>\u00a0foundation-day1<\/code>. Save. Do not modify access, networking, policies, secrets, or production resources.<\/li>\n\n\n\n
                      5. In the approved subscription open\u00a0Activity log<\/strong>. Filter by the test resource group, recent timeframe and Administrative operations if needed.<\/li>\n\n\n\n
                      6. Find a successful resource-group\u00a0create\/update\/write<\/strong>\u00a0event. Record its\u00a0operation name<\/strong>,\u00a0time (UTC)<\/strong>,\u00a0actor<\/strong>\u00a0and\u00a0resource identifier<\/strong>. The portal’s text and case can vary.<\/li>\n\n\n\n
                      7. If you do not see it immediately, widen the time filter and inspect a recent Activity log without the group filter. If it still does not exist at the source, do not proceed to the destination and falsely claim collection is working.<\/li>\n<\/ol>\n\n\n\n
                        PASS P05:<\/strong> You have a real source-side activity record for a change you performed<\/strong> on the test resource group. Save P05-source-activity-log.png<\/code>.<\/p>\n\n\n\n
                        Why this is the right first signal:<\/strong> Azure Activity captures control-plane changes such as resource creation and update. A safe tag change demonstrates the flow without simulating a malicious compromise. [MS05] [MS13]<\/p>\n\n\n\n
                        Phase 6 – Prove delivery to the destination workspace using KQL<\/h2>\n\n\n\n
                        Step A – Access the correct logs query surface<\/h3>\n\n\n\n
                          \n
                        1. Open the\u00a0Azure Activity connector<\/strong>\u00a0in Defender and choose its\u00a0Go to log analytics<\/strong>\u00a0path if available; this opens the relevant hunting\/query experience. Otherwise open\u00a0Investigation & response > Hunting > Advanced hunting<\/strong>\u00a0and select the correct workspace data scope.<\/li>\n\n\n\n
                        2. The same raw workspace query can also be run from\u00a0Azure portal > Log Analytics workspace > Logs<\/strong>. Use the latter when a query in Defender is not pointed at the intended workspace.<\/li>\n\n\n\n
                        3. Set a time window broad enough for the exercise, such as\u00a0last 24 hours<\/strong>. Note that the UI’s time selector and KQL’s\u00a0ago()<\/code>\u00a0filter can both constrain results.<\/li>\n<\/ol>\n\n\n\n
                          Step B – Confirm that records exist<\/h3>\n\n\n\n
                          AzureActivity\n| where TimeGenerated >= ago(24h)\n| summarize EventCount = count(), LatestEvent = max(TimeGenerated)\n<\/code><\/pre>\n\n\n\n
                          Expected:<\/strong> EventCount<\/code> greater than zero if this workspace has received Azure Activity records. If zero, see the troubleshooting ladder. A count above zero could still be someone else’s event<\/strong>, so it does not complete the lab.<\/p>\n\n\n\n
                          Step C – Inspect exact fields and the test group<\/h3>\n\n\n\n
                          Run this more permissive query first, replacing both quoted values<\/strong>:<\/p>\n\n\n\n
                          let labSubscription = \"REPLACE_WITH_YOUR_SUBSCRIPTION_ID\";\nlet labResourceGroup = \"rg-sentinel-signal-s01\";\nAzureActivity\n| where TimeGenerated >= ago(24h)\n| where SubscriptionId =~ labSubscription\n| where ResourceId contains labResourceGroup or ResourceGroup contains labResourceGroup\n| project TimeGenerated, Caller, CategoryValue, ResourceId, ResourceGroup,\n          OperationNameValue, ActivityStatusValue, CorrelationId, SubscriptionId\n| sort by TimeGenerated desc\n<\/code><\/pre>\n\n\n\n
                          Expected:<\/strong> A record containing the test group name that matches the actor, subscription, and approximate event time from Phase 5.<\/p>\n\n\n\n
                          Important:<\/strong> Microsoft warns that Azure Activity fields can differ in casing. The query deliberately uses case-insensitive operations (=~<\/code> and contains<\/code>). [MS05] [MS07]<\/p>\n\n\n\n
                          Step D – Isolate the resource-group write operation<\/h3>\n\n\n\n
                          This is the detection candidate. Do not use it until Step C returns the expected row.<\/strong><\/p>\n\n\n\n
                          let labSubscription = \"REPLACE_WITH_YOUR_SUBSCRIPTION_ID\";\nlet labResourceGroup = \"rg-sentinel-signal-s01\";\nAzureActivity\n| where TimeGenerated >= ago(2h)\n| where SubscriptionId =~ labSubscription\n| where CategoryValue =~ \"Administrative\"\n| where OperationNameValue contains \"resourcegroups\/write\"\n| where ResourceId contains labResourceGroup or ResourceGroup contains labResourceGroup\n| project TimeGenerated, Caller, ResourceId, ResourceGroup,\n          OperationNameValue, ActivityStatusValue, CorrelationId, SubscriptionId\n| sort by TimeGenerated desc\n<\/code><\/pre>\n\n\n\n
                          If the source event’s actual<\/strong> OperationNameValue<\/code> differs, use the value observed in Step C rather than assuming a generic operation name. Keep the resource-group and subscription filters so the query cannot match unrelated production activity.<\/p>\n\n\n\n
                          Step E – Explain the result as a SOC analyst<\/h3>\n\n\n\n
                          For your best matching row<\/strong>, write down:<\/p>\n\n\n\n
                            \n
                          • TimeGenerated<\/code>\u00a0(UTC):\u00a0________________<\/code><\/li>\n\n\n\n
                          • Caller<\/code>:\u00a0________________<\/code><\/li>\n\n\n\n
                          • ResourceId<\/code>:\u00a0________________<\/code><\/li>\n\n\n\n
                          • OperationNameValue<\/code>:\u00a0________________<\/code><\/li>\n\n\n\n
                          • ActivityStatusValue<\/code>:\u00a0________________<\/code><\/li>\n\n\n\n
                          • CorrelationId<\/code>\u00a0(if present):\u00a0________________<\/code><\/li>\n\n\n\n
                          • Is this\u00a0your approved lab action<\/strong>? Why?\u00a0________________<\/code><\/li>\n<\/ul>\n\n\n\n
                            PASS P06:<\/strong> AzureActivity<\/code> contains the same authorized operation as the source Activity log; the detection candidate returns at least one appropriate record; student explains what each selected field means. Save P06-kql-proof.png<\/code> and the exact successful query text.<\/p>\n\n\n\n
                            Do not continue<\/strong> if your query returns no matching record: a detection that cannot match a signal cannot reliably prove the rule-to-incident workflow.<\/p>\n\n\n\n
                            Optional offline KQL mini-exercise (does NOT count as real ingestion)<\/h3>\n\n\n\n
                            When access is blocked, this query helps learners practice a pipeline inside the query engine<\/strong> without ingesting anything:<\/p>\n\n\n\n
                            datatable(TimeGenerated:datetime, Actor:string, Operation:string, Lab:string)\n[\n  datetime(2026-10-01T09:00:00Z), \"student01\", \"resourcegroups\/write\", \"foundation\",\n  datetime(2026-10-01T09:10:00Z), \"student02\", \"resourcegroups\/read\",  \"foundation\",\n  datetime(2026-10-01T09:20:00Z), \"student01\", \"resourcegroups\/write\", \"foundation\"\n]\n| where Operation contains \"write\"\n| summarize Changes=count() by Actor\n<\/code><\/pre>\n\n\n\n
                            Expected:<\/strong> student01<\/code> has 2 matching writes. This demonstrates where<\/code> and summarize<\/code>. It produces no ingested security telemetry, no scheduled alert and no actual incident<\/strong>. Never use this synthetic query as the sole proof of a live detection.<\/p>\n\n\n\n
                            Day 1 sign-off<\/h3>\n\n\n\n
                              \n
                            • [ ] P01 subscription and scope verified.<\/li>\n\n\n\n
                            • [ ] P02 approved Log Analytics workspace verified.<\/li>\n\n\n\n
                            • [ ] P03 Sentinel enabled and Defender portal available.<\/li>\n\n\n\n
                            • [ ] P04 Azure Activity collection configuration verified.<\/li>\n\n\n\n
                            • [ ] P05 test change visible at the source.<\/li>\n\n\n\n
                            • [ ] P06 matching\u00a0AzureActivity<\/code>\u00a0row visible in destination.<\/li>\n<\/ul>\n\n\n\n
                              Day 1 stopping rule:<\/strong> Without P06, the learner does not proceed to the detection phase until the collection issue is fixed or the instructor supplies a prevalidated workspace.<\/p>\n\n\n\n
                              \n\n\n\n
                              DAY 2 – From real telemetry to an investigated incident<\/h1>\n\n\n\n
                              Phase 7 – Analyze the event like a first-line SOC analyst<\/h2>\n\n\n\n
                              Goal:<\/strong> Turn raw log evidence into an explainable finding before attempting an alert.<\/p>\n\n\n\n
                                \n
                              1. Run the Phase 6 query and sort descending by time.<\/li>\n\n\n\n
                              2. Identify whether multiple records belong to the same logical operation (for example start and success states). Do not call two records two separate attacks.<\/li>\n\n\n\n
                              3. Run this summary query:<\/li>\n<\/ol>\n\n\n\n
                                let labResourceGroup = \"rg-sentinel-signal-s01\";\nAzureActivity\n| where TimeGenerated >= ago(24h)\n| where ResourceId contains labResourceGroup or ResourceGroup contains labResourceGroup\n| summarize Operations=count(), LatestEvent=max(TimeGenerated)\n  by OperationNameValue, ActivityStatusValue\n| sort by Operations desc\n<\/code><\/pre>\n\n\n\n
                                  \n
                                1. Answer these questions: Which event was expected? Who initiated it? Which resource was changed? Was it successful? What additional evidence would you seek before treating it as suspicious?<\/li>\n\n\n\n
                                2. Record\u00a0a short analyst narrative<\/strong>: “A resource group was modified by [actor] at [UTC time]. The change was [authorized\/unverified]. Evidence: [Activity log + KQL rows]. Next action: [close as training \/ escalate for authorization check].”<\/li>\n<\/ol>\n\n\n\n
                                  PASS P07:<\/strong> A reproducible KQL summary, accurate reading of the source event, and no unsupported claim that the authorized action is an attack.<\/p>\n\n\n\n
                                  Phase 8 – Discover built-in detection content (and understand the limitation)<\/h2>\n\n\n\n
                                  The Foundation syllabus includes rule templates<\/strong>. Explore them here, but use Phase 9’s controlled rule to prove the whole workflow.<\/p>\n\n\n\n
                                    \n
                                  1. In Defender portal open\u00a0Microsoft Sentinel > Content hub<\/strong>\u00a0and locate the installed\u00a0Azure Activity<\/strong>\u00a0solution.<\/li>\n\n\n\n
                                  2. Look for the documented\u00a0Suspicious Resource deployment<\/strong>\u00a0template (availability depends on installed solution\/version).<\/li>\n\n\n\n
                                  3. Read its prerequisites, query\/table dependencies, threshold and intended threat scenario.<\/li>\n\n\n\n
                                  4. If the instructor approved enabling it in a sandbox, choose\u00a0Create rule<\/strong>\u00a0from the template, confirm its data prerequisites, and review all settings. If not, perform a read-only walkthrough.<\/li>\n\n\n\n
                                  5. Compare that built-in rule with the training query: the built-in rule seeks a security-relevant pattern, whereas this lab’s custom rule intentionally detects\u00a0one authorized group change<\/em>.<\/li>\n\n\n\n
                                  6. Record whether it was\u00a0only inspected<\/strong>,\u00a0created but disabled<\/strong>, or\u00a0enabled<\/strong>. Disable any temporary rule that is noisy or unrelated.<\/li>\n<\/ol>\n\n\n\n
                                    PASS P08:<\/strong> Student can differentiate installed solution<\/strong>, rule template<\/strong>, active rule<\/strong>, alert<\/strong> and incident<\/strong>. Merely enabling a built-in template does not guarantee an alert<\/strong> from your harmless test event. [MS01] [MS08]<\/p>\n\n\n\n
                                    Phase 9 – Create a temporary scheduled analytics rule from your proved query<\/h2>\n\n\n\n
                                    \n
                                    Security notice:<\/strong> This short-lived rule is named TRAINING ONLY<\/strong>. It alerts on a known benign change. Do not assign a fictional ATT&CK technique, label it a real threat, route to production incident responders or attach a playbook.<\/p>\n<\/blockquote>\n\n\n\n
                                    Step A – Rule definition<\/h3>\n\n\n\n
                                      \n
                                    1. In Defender portal select\u00a0Microsoft Sentinel > Configuration > Analytics > + Create > Scheduled query rule<\/strong>.<\/li>\n\n\n\n
                                    2. Set a unique\u00a0Name<\/strong>, for example\u00a0LAB-FOUNDATION-s01-RG-WRITE<\/code>.<\/li>\n\n\n\n
                                    3. Description:\u00a0TRAINING ONLY. Detect approved writes to an isolated lab resource group. Disable and remove after exercise.<\/code><\/li>\n\n\n\n
                                    4. Set\u00a0Severity<\/strong>\u00a0to\u00a0Informational<\/strong>\u00a0or Low as approved; choose\u00a0Enabled<\/strong>\u00a0for the temporary controlled test.<\/li>\n\n\n\n
                                    5. Do\u00a0not<\/strong>\u00a0assert MITRE ATT&CK mapping for this benign administrative test.<\/li>\n<\/ol>\n\n\n\n
                                      Step B – Paste proven query and minimize noise<\/h3>\n\n\n\n
                                        \n
                                      1. Copy the exact tested\u00a0Phase 6 Step D<\/strong>\u00a0query. Replace the subscription ID and group name with your actual lab values. Keep\u00a0TimeGenerated<\/code>\u00a0in the projected results; Microsoft explicitly requires it for scheduled-rule lookback evaluation. [MS08]<\/li>\n\n\n\n
                                      2. In\u00a0Set rule logic<\/strong>, paste the query and resolve any validation errors.<\/li>\n\n\n\n
                                      3. If supported in your portal, add\u00a0custom details<\/strong>\u00a0such as\u00a0ResourceId<\/code>\u00a0and\u00a0OperationNameValue<\/code>\u00a0for investigation. Entity mapping may be skipped for this first Foundation exercise; incorrect entity mappings can confuse the incident graph.<\/li>\n\n\n\n
                                      4. Run query every:<\/strong>\u00a05 minutes<\/code>.<\/li>\n\n\n\n
                                      5. Lookup data from the last:<\/strong>\u00a02 hours<\/code>\u00a0(beginner demo only; widen if approved and needed for ingestion delay).<\/li>\n\n\n\n
                                      6. Generate alert when number of query results is greater than:<\/strong>\u00a00<\/code>.<\/li>\n\n\n\n
                                      7. Event grouping:<\/strong>\u00a0Group all events into a single alert<\/code>.<\/li>\n\n\n\n
                                      8. Stop running query after alert is generated:<\/strong>\u00a0On<\/code>, for\u00a01 hour<\/code>\u00a0if the setting is offered. If your environment cannot use it, disable the rule promptly after the first alert to prevent repetitions.<\/li>\n\n\n\n
                                      9. Run\u00a0Test with current data \/ Results simulation<\/strong>\u00a0if available. Record the preview and remember:\u00a0simulation is not an alert<\/strong>.<\/li>\n<\/ol>\n\n\n\n
                                        Step C – Create actual incidents without automated remediation<\/h3>\n\n\n\n
                                          \n
                                        1. On\u00a0Incident settings<\/strong>, ensure\u00a0Create incidents from alerts triggered by this analytics rule = Enabled<\/strong>. When Sentinel is connected to Defender, Microsoft Defender’s incident engine handles creation\/correlation and may group alerts differently from initial settings. [MS08]<\/li>\n\n\n\n
                                        2. On\u00a0Automated responses<\/strong>,\u00a0do not<\/strong>\u00a0add automation rules or playbooks for this Foundation lab.<\/li>\n\n\n\n
                                        3. On\u00a0Review and create<\/strong>, confirm query, workspace, enabled status, threshold, schedule, incident creation and intended scope.<\/li>\n\n\n\n
                                        4. Select\u00a0Create<\/strong>\u00a0only after validation passes and the instructor approves the settings.<\/li>\n\n\n\n
                                        5. Return to\u00a0Active rules<\/strong>. Verify the rule exists and is\u00a0Enabled<\/strong>.<\/li>\n<\/ol>\n\n\n\n
                                          PASS P09:<\/strong> An active, time-limited training rule exists; query and source scope match the KQL that already returned a real row; incident creation is on; no automated remediation is configured. Save P09-rule-settings.png<\/code>.<\/p>\n\n\n\n
                                          Operational note<\/h3>\n\n\n\n
                                          Since the lookback is two hours, a previously ingested event may<\/strong> cause the first alert shortly after rule activation. If none appears and all prerequisites are valid, create a new approved tag update<\/em> after activation, for example changing sentinelTraining<\/code> from foundation-day1<\/code> to foundation-alert-test<\/code>, and then wait for that event to arrive. Do not repeat changes in a tight loop.<\/p>\n\n\n\n
                                          Phase 10 – Observe the real alert and incident<\/h2>\n\n\n\n
                                          Step A – Check the event and alert<\/h3>\n\n\n\n
                                            \n
                                          1. Verify the signal group’s most recent tag update in the\u00a0Azure subscription Activity log<\/strong>.<\/li>\n\n\n\n
                                          2. Rerun the exact rule query against\u00a0AzureActivity<\/code>. A matching row must appear in the appropriate lookback window; capture its timestamp.<\/li>\n\n\n\n
                                          3. Open\u00a0Defender portal > Investigation & response > Incidents & alerts > Alerts<\/strong>. Filter to the recent period and your unique training rule or source.<\/li>\n\n\n\n
                                          4. Record the actual\u00a0Alert ID<\/strong>, name, severity, creation time, rule\/source and matching resource. If none appears, inspect the rule state, simulation result, lookback\/schedule, exact data filters and the queue’s filters; give the service time to process.<\/li>\n\n\n\n
                                          5. A query returning rows is proof of\u00a0data<\/em>, not proof of\u00a0alert generation<\/em>. Do not mark this phase passed until you have a real alert ID.<\/li>\n<\/ol>\n\n\n\n
                                            Step B – Find the incident containing the alert<\/h3>\n\n\n\n
                                              \n
                                            1. Open\u00a0Investigation & response > Incidents & alerts > Incidents<\/strong>.<\/li>\n\n\n\n
                                            2. Search by rule name\/alert\/period and check whether the alert is included in an existing incident rather than assuming every alert becomes a new separate row.<\/li>\n\n\n\n
                                            3. If your tenant is using the incident-cases preview, the comparable location is\u00a0Cases > Incident<\/strong>. Follow the experience actually available; do not try to enable preview in a lab without approval. [MS10] [MS11]<\/li>\n\n\n\n
                                            4. Open the incident\/case, verify it includes the matching alert, and record its ID, severity, status, created time, owner and evidence.<\/li>\n\n\n\n
                                            5. When you have the necessary alert\/incident screenshots,\u00a0disable the training analytics rule now<\/strong>. Leave the incident available for investigation, but stop further repeated alerts.<\/li>\n<\/ol>\n\n\n\n
                                              PASS P10:<\/strong> A real Azure source event, matching ingested AzureActivity<\/code> row, scheduled rule, real alert ID<\/strong>, and real incident\/case ID containing that alert<\/strong>. Save P10-alert.png<\/code> and P10-incident.png<\/code>.<\/p>\n\n\n\n
                                              If an alert is visible but an incident is not, this is a partially completed<\/strong> flow, not a pass. See Section 14.<\/p>\n\n\n\n
                                              Phase 11 – Conduct SOC L1 incident triage and write the incident report<\/h2>\n\n\n\n
                                                \n
                                              1. Open the matching incident\/case from P10.<\/li>\n\n\n\n
                                              2. Verify its title, priority\/severity, alert details, timeline, resource references, actor and any mapped entities (if available).<\/li>\n\n\n\n
                                              3. Assign the incident to the instructor-approved training analyst if your permissions allow it. Read-only participants instead document the intended owner.<\/li>\n\n\n\n
                                              4. Use the\u00a0Source Activity log<\/strong>\u00a0and\u00a0KQL query<\/strong>\u00a0as independent evidence. Explain the difference between\u00a0the time the action occurred<\/strong>\u00a0and\u00a0the time an alert\/incident was created<\/strong>.<\/li>\n\n\n\n
                                              5. Evaluate whether the resource change was authorized, expected, harmful or unknown. For this exercise, the instructor knows it was authorized.<\/li>\n\n\n\n
                                              6. Write an investigation note in the incident\/case if allowed. Do not include access tokens, secrets, personal contact details or confidential enterprise information.<\/li>\n\n\n\n
                                              7. Resolve\/close it with the equivalent of\u00a0Informational \/ expected activity<\/strong>\u00a0or\u00a0Benign positive<\/strong>\u00a0when supported by the applicable UI; if classification labels differ, choose the closest accurate meaning and document the mapping. Do not classify a true benign test as a confirmed security compromise.<\/li>\n\n\n\n
                                              8. If the status\/close action is not available, record the exact permission blocker and have an authorized instructor perform it.<\/li>\n<\/ol>\n\n\n\n
                                                Learner incident report – complete this template<\/h3>\n\n\n\n
                                                INCIDENT REPORT - FOUNDATION TRAINING\nStudent \/ cohort:\nTimestamp and timezone (UTC):\nSubscription \/ workspace:\nSignal resource group:\nSource Activity log event time:\nEvent operation name and result:\nActor \/ initiating identity:\nKQL query used (file or paste):\nMatching AzureActivity evidence:\nAnalytics rule name:\nAlert ID and alert creation time:\nIncident \/ case ID and creation time:\nIncident owner:\nWas this authorized? What evidence proves it?:\nClassification and rationale:\nImmediate action taken (normally none \/ training closure):\nEscalation needed? Why \/ why not?:\nRule disabled after exercise? Evidence:\nInstructor review:\n<\/code><\/pre>\n\n\n\n
                                                What a good analyst should conclude<\/h3>\n\n\n\n
                                                An approved Azure configuration change is expected activity<\/strong>. It should produce a verifiable record and, because we intentionally configured a training detector, may produce an alert. An alert does not equal compromise.<\/strong> A strong analyst documents the approval and evidence, closes the training incident appropriately and recommends not<\/strong> using this simplistic alert rule for production. [MS10] [MS11]<\/p>\n\n\n\n
                                                PASS P11:<\/strong> Complete evidence-based report, defensible disposition, and safe closure or documented permissions blocker. Save P11-triage-report.md<\/code> and an authorized screenshot of the close\/classification state.<\/p>\n\n\n\n
                                                Phase 12 – Read a workbook and answer a real SOC question<\/h2>\n\n\n\n
                                                  \n
                                                1. Open\u00a0Microsoft Sentinel > Threat management > Workbooks<\/strong>.<\/li>\n\n\n\n
                                                2. Search for an\u00a0Azure Activity<\/strong>\u00a0workbook\/template included with the installed solution, if available.<\/li>\n\n\n\n
                                                3. Inspect its\u00a0Required data types<\/strong>, select the appropriate workspace and open it.<\/li>\n\n\n\n
                                                4. If it must be saved before use, have a permitted instructor\/learner select\u00a0Save<\/strong>\u00a0and the correct subscription\/RG. Workbooks require distinct Reader\/Contributor permissions. [MS09]<\/li>\n\n\n\n
                                                5. Adjust any time-range and subscription filters to cover your lab event. Refresh.<\/li>\n\n\n\n
                                                6. Locate a panel describing activity by\u00a0operation<\/strong>,\u00a0actor<\/strong>,\u00a0status<\/strong>\u00a0or\u00a0time<\/strong>. Record one useful finding and one limitation.<\/li>\n\n\n\n
                                                7. If the template cannot be viewed due to permissions or visual feature availability, document the blocker and demonstrate a simple KQL summary instead; call it a\u00a0fallback<\/strong>, not a saved workbook.<\/li>\n<\/ol>\n\n\n\n
                                                  Student questions:<\/strong><\/p>\n\n\n\n
                                                    \n
                                                  • Which administrative operation did the test create?<\/li>\n\n\n\n
                                                  • How does the chart’s aggregation differ from the individual event row?<\/li>\n\n\n\n
                                                  • Why might the chart initially show nothing even though the event is in\u00a0AzureActivity<\/code>?<\/li>\n\n\n\n
                                                  • Which SOC question is answered well by this workbook, and which question would require querying raw logs?<\/li>\n<\/ul>\n\n\n\n
                                                    PASS P12:<\/strong> Student identifies the relevant dataset, one actual visualization, and its limits. Save P12-workbook.png<\/code> or mark the workbook as blocked with the specific reason.<\/p>\n\n\n\n
                                                    \n\n\n\n
                                                    13. End-to-end evidence chain: the student’s final walkthrough<\/h2>\n\n\n\n
                                                    The student must reconstruct this in order<\/strong>, pointing to an artifact for each arrow:<\/p>\n\n\n\n
                                                    Boundary<\/th>Evidence artifact<\/th>Pass?<\/th><\/tr><\/thead>
                                                    Approved subscription -> workspace<\/td>P01 + P02 screenshots and subscription\/workspace notes<\/td>PASS \/ BLOCKED<\/td><\/tr>
                                                    Workspace -> Sentinel\/Defender<\/td>P03 workspace view<\/td>PASS \/ BLOCKED<\/td><\/tr>
                                                    Activity-log export configured<\/td>P04 connector\/diagnostic\/policy record<\/td>PASS \/ BLOCKED<\/td><\/tr>
                                                    Approved change -> source event<\/td>P05 Activity log event with time and resource<\/td>PASS \/ BLOCKED<\/td><\/tr>
                                                    Source event -> destination KQL row<\/td>P06 matching AzureActivity<\/code> row<\/td>PASS \/ BLOCKED<\/td><\/tr>
                                                    Log row -> explainable analyst summary<\/td>P07 source\/query interpretation<\/td>PASS \/ BLOCKED<\/td><\/tr>
                                                    Built-in content understanding<\/td>P08 template vs active-rule explanation<\/td>PASS \/ BLOCKED<\/td><\/tr>
                                                    Tested query -> active scheduled rule<\/td>P09 rule validation and active state<\/td>PASS \/ BLOCKED<\/td><\/tr>
                                                    Rule -> real alert<\/strong> -> real incident<\/strong><\/td>P10 Alert ID + incident\/case ID<\/td>PASS \/ BLOCKED<\/td><\/tr>
                                                    Incident -> documented disposition<\/td>P11 case report and closure\/ownership<\/td>PASS \/ BLOCKED<\/td><\/tr>
                                                    Logs -> visualization<\/td>P12 workbook result and interpretation<\/td>PASS \/ BLOCKED<\/td><\/tr>
                                                    Lab -> safe teardown<\/td>Section 15 cleanup record<\/td>PASS \/ BLOCKED<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                                    Never fill in an ID that the platform did not actually create.<\/strong> A screenshot of an instructor-provided example must be labeled instructor demo<\/em>, not a student’s executed result.<\/p>\n\n\n\n
                                                    14. Troubleshooting: locate the exact broken boundary<\/h2>\n\n\n\n
                                                    A single diagnostic ladder<\/h3>\n\n\n\n
                                                    NoYesNoYesNoYesNoYesNoYesNoYesNoYesDid approved Azure change succeed?Is change visible in source Activity log?Does approved export target the correct workspace?Does AzureActivity show test event?Does rule query match a row within its lookback?Did the scheduled rule generate a real alert?Does a Defender incident contain the alert?Complete investigation and close as expected training activityFix permissions \/ resource-group operationCorrect subscription \/ time \/ scope filtersFix policy or diagnostic settings with ownerVerify ingestion delay, scope, destination, query contextInspect actual fields; correct name, time, operatorCheck enabled state, schedule, threshold, suppression, executionCheck incident creation, filters, correlation and access<\/pre>\n\n\n\n
                                                    Symptom-to-action table<\/h3>\n\n\n\n
                                                    Symptom<\/th>Likely cause<\/th>Next safe validation<\/th><\/tr><\/thead>
                                                    Can’t add Sentinel to workspace<\/td>Subscription Contributor permission missing, wrong subscription, unsupported existing workspace<\/td>Check subscription filter and onboarding prerequisites [MS01]<\/td><\/tr>
                                                    Workspace invisible in Defender<\/td>Not onboarded, wrong tenant\/workspace, insufficient onboarding role<\/td>Settings > Microsoft Sentinel > Workspaces; involve admin [MS02]<\/td><\/tr>
                                                    Content hub Install unavailable<\/td>Missing Microsoft Sentinel Contributor or other content dependency<\/td>Review RG-scoped role assignments [MS03]<\/td><\/tr>
                                                    Azure Activity connector shows Not connected<\/td>No approved export, wrong workspace, delayed reporting<\/td>Review actual policy\/diagnostic settings; do not rely solely on badge<\/td><\/tr>
                                                    Source Activity log has no test event<\/td>Change failed, incorrect subscription\/time filter<\/td>Inspect resource group, source subscription and activity log directly<\/td><\/tr>
                                                    AzureActivity<\/code> table missing \/ empty<\/td>No ingestion yet, wrong workspace, permissions, connector\/export issue<\/td>Query correct Log Analytics workspace and review collection settings<\/td><\/tr>
                                                    Broad KQL returns rows but filtered KQL doesn’t<\/td>Wrong RG spelling, activity field casing, different operation name, too narrow time<\/td>Inspect broad query results and reconstruct filter from actual values<\/td><\/tr>
                                                    Scheduled rule fails validation<\/td>Missing TimeGenerated<\/code>, invalid KQL, unsupported rule setting<\/td>Run query in Logs first; review wizard validation [MS08]<\/td><\/tr>
                                                    Rule enabled, no alert<\/td>Event not in lookback, threshold\/suppression, not yet evaluated<\/td>Check actual data, results simulation, rule state and run timing<\/td><\/tr>
                                                    Alert visible, no new incident row<\/td>Incident creation off, Defender correlation put alert in another incident, filters\/permissions<\/td>Search existing incident for matching alert; review rule settings [MS08]<\/td><\/tr>
                                                    Can’t assign\/resolve incident<\/td>Missing Responder or Defender management permissions<\/td>Use read-only report; instructor handles changes [MS03] [MS11]<\/td><\/tr>
                                                    Workbook looks empty<\/td>Wrong data type, workspace, time range or workbook permission<\/td>Inspect Required data types and time\/source filters [MS09]<\/td><\/tr>
                                                    Too many alerts<\/td>Wide lookback, short frequency, disabled suppression<\/td>Disable lab rule immediately; document cause and fix before rerun<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                                    Rule-of-thumb troubleshooting order<\/h3>\n\n\n\n
                                                      \n
                                                    1. Source:<\/strong>\u00a0Was the actual change made and logged?<\/li>\n\n\n\n
                                                    2. Transport:<\/strong>\u00a0Was the correct subscription exported to the correct workspace?<\/li>\n\n\n\n
                                                    3. Schema and time:<\/strong>\u00a0Does the destination record match expected columns and time?<\/li>\n\n\n\n
                                                    4. Rule:<\/strong>\u00a0Does the exact rule query return recent data and does its schedule run?<\/li>\n\n\n\n
                                                    5. Alert and incident:<\/strong>\u00a0Did the actual alert appear, and where did Defender group it?<\/li>\n\n\n\n
                                                    6. Authorization:<\/strong>\u00a0Do you have permission to see\/manage the target artifact?<\/li>\n<\/ol>\n\n\n\n
                                                      No stage should be marked PASS<\/strong> merely because a later screenshot seems plausible.<\/p>\n\n\n\n
                                                      \n\n\n\n
                                                      15. Clean up and prevent ongoing charges or noise<\/h2>\n\n\n\n
                                                      Cleanup is part of the graded lab. Do not delete an instructor-owned shared workspace or any organization-wide policy.<\/strong><\/p>\n\n\n\n
                                                        \n
                                                      1. Disable the temporary scheduled rule<\/strong>\u00a0as soon as you have the alert evidence (Phase 10). Confirm its status is disabled.<\/li>\n\n\n\n
                                                      2. Complete incident evidence and resolution; verify the case and comments remain available for grading if required.<\/li>\n\n\n\n
                                                      3. If the rule belongs only to your student sandbox and the instructor approves, delete it from\u00a0Analytics > Active rules<\/strong>. Document the action.<\/li>\n\n\n\n
                                                      4. Remove any temporary built-in test rule you explicitly created, but do\u00a0not<\/strong>\u00a0uninstall a Content hub solution used by other learners without approval.<\/li>\n\n\n\n
                                                      5. For the\u00a0test resource group<\/strong>\u00a0(which must be empty other than approved tags), delete the group only if the instructor confirms it is\u00a0solely yours<\/strong>\u00a0and not used as a shared signal source. Copy its resource ID first for evidence.<\/li>\n\n\n\n
                                                      6. For a\u00a0newly created direct diagnostic setting<\/strong>, obtain the collection owner’s approval before removing it from the source subscription. For an\u00a0Azure Policy assignment<\/strong>, coordinate removal\/remediation with the policy owner; removing a policy assignment may not automatically clean up all deployed diagnostic settings.<\/li>\n\n\n\n
                                                      7. Delete your\u00a0new workspace\/resource group<\/strong>\u00a0only if it is not needed for later days and the environment owner explicitly approves. Check that no existing data collection or downstream teaching work depends on it.<\/li>\n\n\n\n
                                                      8. Review the approved cost\/budget view for usage accrued by the exercise. Note any extra services installed during class.<\/li>\n\n\n\n
                                                      9. Save the cleanup record:<\/li>\n<\/ol>\n\n\n\n
                                                        CLEANUP REPORT\nStudent ID:\nLab subscription and resource group:\nRule name and final state:\nIncident ID and final classification\/status:\nSignal RG status (retained\/deleted by owner):\nExport diagnostic setting\/policy (retained\/removed by owner):\nWorkspace status (retained\/deleted by owner):\nCost owner notified:\nOpen issues and next owner:\nTimestamp:\n<\/code><\/pre>\n\n\n\n
                                                        PASS P13:<\/strong> Training alert noise has stopped and the ownership\/status of every resource or collection route is documented. The goal is not “delete everything”; it is controlled, reversible, auditable cleanup<\/strong>.<\/p>\n\n\n\n
                                                        \n\n\n\n
                                                        16. Final Foundation skills assessment – 100 points<\/h2>\n\n\n\n
                                                        Competency<\/th>Points<\/th>Required evidence<\/th><\/tr><\/thead>
                                                        Correct tenant, subscription, Azure scope and safety controls<\/td>10<\/td>P01, permission\/cost decisions<\/td><\/tr>
                                                        Correct workspace + Sentinel + Defender access<\/td>10<\/td>P02-P03<\/td><\/tr>
                                                        Correct and approved Azure Activity export<\/td>10<\/td>P04<\/td><\/tr>
                                                        Harmless source event and matching ingested destination record<\/td>15<\/td>P05-P06 (both must be real)<\/td><\/tr>
                                                        Accurate KQL analysis and explainable SOC narrative<\/td>15<\/td>P06-P07<\/td><\/tr>
                                                        Content template understanding + correctly configured custom lab rule<\/td>10<\/td>P08-P09<\/td><\/tr>
                                                        Actual alert + incident evidence<\/strong><\/td>15<\/strong><\/td>P10: real IDs, source association<\/strong><\/td><\/tr>
                                                        Incident triage, classification and report<\/td>10<\/td>P11<\/td><\/tr>
                                                        Workbook and limitations<\/td>3<\/td>P12<\/td><\/tr>
                                                        Safe disabling\/cleanup documentation<\/td>2<\/td>P13<\/td><\/tr>
                                                        Total<\/strong><\/td>100<\/strong><\/td><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                                        Progression gate to Intermediate<\/h3>\n\n\n\n
                                                          \n
                                                        • Recommended passing score:\u00a080\/100<\/strong>.<\/li>\n\n\n\n
                                                        • Mandatory live competencies:<\/strong>\u00a0P05, P06, P09, P10 and safe disabling\/cleanup must be demonstrated\u00a0or individually checked off by an instructor after successful remediation<\/strong>. A higher score cannot replace missing real evidence.<\/li>\n\n\n\n
                                                        • In Mode B, instructor-provisioned infrastructure is acceptable, but evidence must show that the student’s event reached the correct destination and produced the claimed alert and incident.<\/li>\n\n\n\n
                                                        • In Mode C, students may pass a\u00a0KQL\/concepts practice check<\/strong>, not the full end-to-end practical gate.<\/li>\n<\/ul>\n\n\n\n
                                                          Instructor answer key \/ expected reasoning<\/h3>\n\n\n\n
                                                            \n
                                                          1. What is an event?<\/strong>\u00a0An Azure Activity entry describes a control-plane operation; the meaning depends on actor, subscription, scope, timestamp and result.<\/li>\n\n\n\n
                                                          2. Why do we need export?<\/strong>\u00a0The source Azure Activity log exists before Sentinel; a configured pipeline delivers relevant events to the Log Analytics table.<\/li>\n\n\n\n
                                                          3. Does a\u00a0Connected<\/code>\u00a0label prove an event arrived?<\/strong>\u00a0No. The proof is a source event matched to the destination record.<\/li>\n\n\n\n
                                                          4. What does KQL establish?<\/strong>\u00a0The analyst can filter, summarize and inspect evidence in the connected table.<\/li>\n\n\n\n
                                                          5. What makes this a scheduled rule?<\/strong>\u00a0Sentinel reruns the tested query on a configured interval\/lookback and creates an alert when the threshold is met.<\/li>\n\n\n\n
                                                          6. Is\u00a0Test with current data<\/code>\u00a0a real alert?<\/strong>\u00a0No. It is a rule simulation.<\/li>\n\n\n\n
                                                          7. Is the alert necessarily malicious?<\/strong>\u00a0No. This alert deliberately indicates authorized lab activity; classify based on corroborated context.<\/li>\n\n\n\n
                                                          8. Why might an alert not create a separate incident row?<\/strong>\u00a0In Defender, incident correlation can put it into an existing incident; check incident creation and search for the alert ID.<\/li>\n\n\n\n
                                                          9. What does a workbook add?<\/strong>\u00a0Visual summaries for repeated SOC questions. The underlying source and filters must still be validated.<\/li>\n\n\n\n
                                                          10. What is the final analyst action?<\/strong>\u00a0Document expected activity, close appropriately, disable noisy demo detection and preserve graded evidence.<\/li>\n<\/ol>\n\n\n\n
                                                            Oral demonstration: ask the student to trace the whole flow<\/h3>\n\n\n\n
                                                            \n
                                                            “I changed this approved resource group; here is the corresponding Azure source event. This subscription export delivered it to my Sentinel workspace’s AzureActivity<\/code> table. Here is the filtered KQL row, my rule’s configured threshold\/lookback, the real alert, its incident, my authorized-activity classification and the disabled test rule. This workbook summarizes the underlying activity.”<\/p>\n<\/blockquote>\n\n\n\n
                                                            If a learner can prove<\/strong> that narrative from their own artifacts and correctly explain its limitations, they understand the essential Foundations workflow.<\/p>\n\n\n\n
                                                            \n\n\n\n
                                                            17. Student submission checklist<\/h2>\n\n\n\n
                                                            Submit one folder (for example Sentinel-Foundations-s01<\/code>) containing:<\/p>\n\n\n\n
                                                            Sentinel-Foundations-s01\/\n  README.md                  # Student, selected Mode A\/B\/C, context, limitations\n  P01-subscription-scope.png\n  P02-workspace-overview.png\n  P03-defender-workspace.png\n  P04-activity-connector.png\n  P05-source-activity-log.png\n  P06-kql-proof.png\n  P07-analysis.md\n  P08-template-notes.md\n  P09-rule-settings.png\n  P10-alert.png\n  P10-incident.png\n  P11-triage-report.md\n  P12-workbook.png\n  P13-cleanup.md\n  query.kql                  # Copy of final tested query with no secrets\n<\/code><\/pre>\n\n\n\n
                                                            If a screenshot is unavailable because of permissions or the mode used, submit BLOCKED-<checkpoint>.md<\/code> documenting the exact obstacle and an authorized alternative. Do not invent screenshots, claim simulations were real alerts, or publish private subscription\/user identifiers on a public training site.<\/p>\n\n\n\n
                                                            \n\n\n\n
                                                            18. Verified official references and change-check list<\/h2>\n\n\n\n
                                                            These references were reviewed for the November 1, 2026<\/strong> edition. Exact button labels, permissions, licensing, and portal previews may change between cohorts. DOC-VERIFIED<\/strong> means the Microsoft article documents the workflow; LIVE-UNVERIFIED<\/strong> means this manual was not executed in your subscription. The instructor must complete P01-P13 once in the actual training tenant before delivery.<\/p>\n\n\n\n
                                                            ID<\/th>Official Microsoft documentation<\/th>Used for<\/th><\/tr><\/thead>
                                                            MS01<\/td>Onboard Microsoft Sentinel to a Log Analytics workspace<\/a><\/td>Workspace, Sentinel setup, Content hub, Azure Activity connector<\/td><\/tr>
                                                            MS02<\/td>Connect Microsoft Sentinel to the Defender portal<\/a><\/td>Workspace onboarding, Defender navigation and requirements<\/td><\/tr>
                                                            MS03<\/td>Roles and permissions in Microsoft Sentinel<\/a><\/td>Reader\/Responder\/Contributor responsibilities<\/td><\/tr>
                                                            MS04<\/td>Microsoft Sentinel in the Defender portal<\/a><\/td>Interface direction and support transition<\/td><\/tr>
                                                            MS05<\/td>Azure Monitor Activity log<\/a><\/td>Source operations, AzureActivity, case-insensitive fields, ingestion notes<\/td><\/tr>
                                                            MS06<\/td>Azure Monitor diagnostic settings<\/a><\/td>Direct subscription activity export and precautions<\/td><\/tr>
                                                            MS07<\/td>AzureActivity table reference<\/a><\/td>Query column names and types<\/td><\/tr>
                                                            MS08<\/td>Create scheduled analytics rules<\/a><\/td>TimeGenerated<\/code>, schedules, lookback, thresholds, incident setting and suppression<\/td><\/tr>
                                                            MS09<\/td>Visualize data using Microsoft Sentinel workbooks<\/a><\/td>Workbooks and access requirements<\/td><\/tr>
                                                            MS10<\/td>Manage incidents in Defender portal (legacy experience)<\/a><\/td>Incident ownership, expected activity, notes and resolution<\/td><\/tr>
                                                            MS11<\/td>Manage incident cases in Defender portal (preview)<\/a><\/td>Case management differences and permissions<\/td><\/tr>
                                                            MS12<\/td>Create scheduled rule from a template<\/a><\/td>Built-in rule template discovery<\/td><\/tr>
                                                            MS13<\/td>Azure Activity log event schema<\/a><\/td>Administrative write-event interpretation<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                                            Before every course delivery, instructor recheck<\/h3>\n\n\n\n
                                                              \n
                                                            • [ ] Defender portal > workspace is connected and learners can see the intended scope.<\/li>\n\n\n\n
                                                            • [ ] The Azure Activity solution\/connector remains installed and source export is authorized.<\/li>\n\n\n\n
                                                            • [ ] The\u00a0live<\/strong>\u00a0event query returns a correct row before an analytics rule is configured.<\/li>\n\n\n\n
                                                            • [ ] The scheduled-rule wizard supports the chosen lookback, interval and suppression in this environment.<\/li>\n\n\n\n
                                                            • [ ] A controlled test produces a real alert and Defender incident in the current incident UI.<\/li>\n\n\n\n
                                                            • [ ] Labels for closing expected activity are recorded for your tenant.<\/li>\n\n\n\n
                                                            • [ ] No lab rule or resource has a production blast radius; cleanup roles are assigned.<\/li>\n\n\n\n
                                                            • [ ] Entitlements, preview availability and pricing have been checked for the delivery date.<\/li>\n<\/ul>\n\n\n\n
                                                              Validated offline for this publication:<\/strong> syllabus fit, Markdown structure, KQL composition against documented schema, field names, architecture coherence, evidence gates, and safety sequencing.<\/p>\n\n\n\n
                                                              Not asserted:<\/strong> Live execution in your Microsoft tenant, guaranteed event delivery timing, guaranteed zero cost, identical portal menus in every tenant, or a generated incident where no real alert was observed.<\/p>\n\n\n\n
                                                              \n\n\n\n
                                                              End of Foundation End-to-End Student Lab Manual<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"
                                                              Student workbook + instructor validation and answer key | Days 1-2 | 2026-11-01 edition One lab, one continuous story: Build a Microsoft Sentinel environment, connect Azure Activity logs,… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1260","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1260","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=1260"}],"version-history":[{"count":2,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1260\/revisions"}],"predecessor-version":[{"id":1270,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1260\/revisions\/1270"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=1260"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=1260"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=1260"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}