ProjectsNovember 19, 2023Azure Sentinel (SIEM) and Honeypot
Overview
Proficiently configured an Azure Sentinel (Microsoft's cloud SIEM) workbook to visualize global attack data, specifically focusing on RDP brute force attacks, by mapping their physical locations and gauging attack magnitudes.
Key Features
- Honeypot Deployment: Setup an intentionally vulnerable Virtual Machine in Azure to attract malicious traffic and automated attacks.
- Data Extraction: Streamlined data extraction from Windows Event Viewer with an efficient PowerShell script.
- Geolocation Integration: Integrated with a third-party API for geolocation of attacker IP addresses.
- Visual Mapping: Represented the attacking countries and IP locations in a world map via Azure Sentinel Workbooks to study the frequency and magnitude of the RDP brute force attacks.
View on GitHubRelated projects
Constructed a dynamic virtualized network using VirtualBox, featuring OPNsense, Kali Linux, and Windows for testing intrusion detection. Engineered a detailed network design topology in VirtualBox and performed protocol sniffing with Wireshark and TShark. 
