Project Case Study
Projects
Non-native telemetry into Microsoft SentinelPrivate Enterprise Work
Sentinel Log Ingestion
Log ingestion for non-native sources in Microsoft Sentinel, including Palo Alto firewall syslog via CEF.
Overview
Log ingestion for non-native sources in Microsoft Sentinel, including Palo Alto firewall syslog via CEF.
Problem
Security telemetry that Sentinel does not natively understand still has to land in useful tables for detection work.
Architecture
An architecture diagram is not included because implementation details are not documented in the portfolio data.
What I Built
- Built log ingestion pipelines in Microsoft Sentinel via DCRs, custom tables, and schemas for non-native telemetry
- Architected a syslog pipeline for Palo Alto firewall logs via CEF forwarding with severity-based filtering
- Validated ingestion accuracy via KQL schema checks and cross-source correlation in Log Analytics
Technical Challenges
Security telemetry that Sentinel does not natively understand still has to land in useful tables for detection work.
Stack
Microsoft SentinelKQLAzureCEFLog Analytics
Validation / Testing
- Project-specific validation details are not documented in the portfolio data.
Current Status
Private Enterprise Work
Private Enterprise Work