Cloud › Module 5 › Lesson 3
Sentinel Named
Sentinel named literacy covers SIEM workspace, data connectors, analytics rules, and incidents — detection vocabulary on YOUR $CLOUD_LAB.
Visual · t31_sentinel_named
Sentinel literacy. $CLOUD_LAB only. Original Cyberlium.
Opening
Azure's cloud SIEM — literacy names connectors and incidents so you triage on subscriptions you own, not export stranger workspace data.
Microsoft Sentinel ingests Azure Activity, Entra ID, Defender, firewalls, and third-party logs into a Log Analytics workspace. Analytics rules (scheduled query, fusion, ML) create incidents with entities and MITRE mapping. L2 triage: confirm scope, pivot entities, correlate with Entra sign-in logs — on owned subscription data only. Cyberlium maps Sentinel vocabulary on YOUR $CLOUD_LAB — connector list and fictional incident card on paper. Next: Azure Lab.
1. Sentinel components (named)
Workspace: Log Analytics home for Sentinel. Data connector: Entra ID, Azure Activity, Defender alerts. Analytics rule: KQL or built-in template firing incidents. Incident: case with severity, entities, owner, comments.
On $CLOUD_LAB, write Sentinel setup sketch — three connectors, one fictional analytics rule purpose, incident triage fields.
Command guide
Try these commands — Sentinel components (named)
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: grep, curl. Reference sites: Microsoft Sentinel (https://learn.microsoft.com/en-us/azure/sentinel/overview); Sentinel data connectors (https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources); Azure Monitor (https://learn.microsoft.com/en-us/azure/azure-monitor/overview). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why Sentinel parallels hunt and SIEM literacy
Same L2 skills: entity pivot, time alignment, hypothesis on sign-in anomalies — Azure-native syntax (KQL) instead of SPL. Defenders restrict workspace RBAC — students design on paper before prod workspace.
Never import employer Sentinel export without ticket — lab fictional incidents only.
3. Literacy ≠ stranger workspace access
Forbidden: using leaked workspace keys to query stranger tenant logs. Allowed: Sentinel named card — connectors, rule purpose, triage checklist on $CLOUD_LAB.
Ship: Sentinel named card for YOUR lab subscription. Next: Azure Lab.
4. What you ship: Sentinel named card for $CLOUD_LAB
Connectors, rule purpose, incident triage fields. $CLOUD_LAB named. NO stranger workspace. chmod 600.
5. What you record before the next lesson
Date. Sentinel card. $CLOUD_LAB named. File t31-m05-l03-sentinel-named.txt chmod 600.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Query stranger Log Analytics with leaked key. Skip entity pivot in triage.
Right
Write Sentinel named card for YOUR $CLOUD_LAB. Next: Azure Lab.
Mission: sketch Sentinel on YOUR lab subscription
1) Name three data connectors for lab tenant. 2) One fictional analytics rule purpose. 3) Incident triage: entities, time, first KQL pivot. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Entra sign-in connector is identity hunt foundation on Azure.
Knowledge Check
APPLY: Microsoft Sentinel is primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Sentinel incidents bundle alerts with entities for analyst triage.
True or False
Knowledge Check
APPLY: Sentinel literacy on Cyberlium avoids:
Multiple choice