Hunting results
Number of query matches by detection
MICROSOFT SENTINEL · AUTOMATION PORTFOLIO
Threat hunting overview
Explore a simulated execution of a real home lab automation workflow.
Demonstration only. All users, IP addresses, events and results are fictional. The actual Azure resources, Excel workbook and email account are never accessed.
PROJECT 06 / SECURITY ENGINEERING HOME LAB
From KQL hunts to
investigation-ready results.
I built an automated threat hunting workflow in Microsoft Sentinel, using Logic Apps to run scheduled queries, record findings and give me a starting point for investigation. Explore the workflow, review the ATT&CK mappings and work through how I investigate the results.
10 KQL HUNTSMICROSOFT SENTINELLOGIC APPS + EXCEL
⌘HUNT ENGINE
KQL 10 hunts
ATT&CK 6 tactics
TRIAGE Guided
Configured hunts ⌕
10Sentinel hunting catalogueQuery matches ▥
16Simulated 7-day lookbackHunts requiring triage ⚑
3Matches ≠ confirmed threatsExecution status ◷
Not runAwaiting manual simulationWorkflow execution
Click a stage to inspect its function
Hunt summary
Run a scenario in Inside my real lab to populate these results
Start here: Explore the actual workflow, then run a fictional scenario to watch Sentinel results appear in the Excel register and completion email. Run it again to compare different outcomes.
REAL IMPLEMENTATION · GUIDED TECHNICAL TOUR
Inside the threat-hunting programme I built
My home lab uses Microsoft Sentinel, Log Analytics, Azure Logic Apps, Sentinel watchlists and an Excel Threat Hunt Register. Follow how the components work together, then replay an offline, fictional example to see how a scheduled hunt becomes an analyst review task.
✓ Architecture based on my implemented lab◇ Demonstration data is fictional⊘ No access to my Azure tenant
Explore the actual workflow
Choose a component to see its purpose, inputs, outputs and design considerations
Scheduled hunting
Implementation walkthrough
INTERACTIVE · OFFLINE REPLAY
Watch the automation run
Follow a fictional execution through the real architecture, from Sentinel to the Excel register and completion email.
Try multiple runs: Choose a scenario and press Start automation again. Each run adds another block to the register.
Compare results: Click a bold run date or use the selector below to view its Hunts, email and execution log.
Run a scenario to explore its results
la-automated-threat-hunting-labLogic Apps · Consumption · UK South
DEMOMicrosoft SentinelHunting + ThreatHunting-ReviewRegister watchlist
Threat Hunt Register.xlsxWeekly Hunt_Data_Log · fictional sample rows appended as the workflow runs
0 / 10 rows| # | Week Commencing | Query Name | Total Query Matches | Action Required | Notes | Final Status | Logic Tuning | Reviewed By |
|---|---|---|---|---|---|---|---|---|
| Press Start automation to watch results appear in the register… | ||||||||
Outlook · Completion notificationFictional email preview
Not sentThe completion email appears here after all ten hunt rows have been appended.
Execution historyStep-by-step demonstration log
- Waiting for a simulated run.
This is a browser-only animation of the implemented workflow. It does not run Azure Logic Apps, query Sentinel, access the actual watchlists, modify Excel or send email. Event counts, dates and messages are fictional.
Implementation evidence and limitations
What was built, and what this public demonstration can and cannot prove
Implemented in the lab
Ten Sentinel hunts, a scheduled/manual Logic App, Log Analytics query execution, Sentinel watchlist reference data, Excel result logging and an email prompting review. The workflow has been run successfully during development.
What is simulated here
Counts, identities, event records, workflow progress and register entries on this site are fictional. No live telemetry, credentials, tenant identifiers or original private KQL are published.
What I would improve
Test each query against known events, document detection validation, strengthen monitoring and error handling, and move from a lab-friendly Excel register toward a more scalable operational datastore if the programme grows.
Logic App execution map
Representative of la-automated-threat-hunting-lab
RECURRENCE / MANUAL RUN → AGGREGATION → ENRICHMENT → REPORTING
Step inspector
How each stage works
The animation runs in your browser. It does not call Azure APIs, execute KQL or send notifications.
Execution log
Illustrative workflow events
Ready to run a simulation.
MY INVESTIGATION METHOD · INTERACTIVE WALKTHROUGH
From a hunt match to an evidence-based decision
When a hunt returns matches, I open the underlying logs to see what's actually happened. I work backwards from the scheduled KQL, examine the underlying activity, cross-check the evidence and record my decision.
TH-001 · Group Management
Select a hunt below, then start a guided investigation.
Choose a hunt and select Start investigation. I'll walk you through the evidence and the decisions I'd make in Sentinel.
This is an interactive demonstration, not a live Sentinel session. The records, identities and IP addresses are fictional. Only the TH-001 investigation pattern is based on the KQL and screenshots I've shared; other hunt walkthroughs are illustrative until their exact KQL is reviewed.
Hunting catalogue
TH-001 through TH-010
TH-001
Entra ID Group Management Activity
Matching events
Fictional investigation data · reserved example IP addresses
My ATT&CK mapping overview
A simple breakdown of mapped and unmapped tactics. This does not measure detection effectiveness.
Explore the complete Enterprise ATT&CK matrix ↗
Select any technique in the matrix below to inspect related hunts and open its official ATT&CK description. Unmapped tactics are not automatically security gaps.
Mapped hunts ▦
10Initial catalogue snapshotUnique mapped techniques ◇
—Including parent techniquesMappings reviewed ✓
2Not detection validationValidated hunts ◷
0Tests not yet recordedATT&CK coverage map
Proposed and reviewed technique mappings — not confirmed adversary coverage
Mapping reviewed Proposed mapping Not mapped in this catalogue
Technique inspector
Select a mapped technique
Detection development backlog
Illustrative ideas to investigate, not verified gaps
| Area | Candidate hunt | Data requirement | Status |
|---|---|---|---|
| Credential Access | Password spray patterns across accounts | Entra SigninLogs | Assess existing TH-003 |
| Persistence | Application credential additions by unexpected principals | Entra AuditLogs | Assess existing TH-005 |
| Defense Evasion | Security monitoring configuration changes | Relevant audit telemetry | Telemetry review |
| Lateral Movement | Unusual remote access behaviour | Endpoint or network logs | Telemetry review |
Privacy by design: This page contains catalogue metadata only. All ten queries remain Private, and no original KQL or tenant data is fetched. Future updates require a separately configured approved publishing pipeline.
Weekly Hunt Data Log
Read-only representation of your Excel Threat Hunt Register