Building a Complete SIEM + SOAR Lab in Microsoft Azure

I built a complete SIEM + SOAR environment in Microsoft Azure as a hands-on learning project. In this article, I’m sharing the full architecture, components, and what I learned while building it.

Architecture Diagram

Here’s the complete architecture diagram of the SIEM + SOAR lab I designed and implemented:

Architecture Diagram (excalidraw) < click here.

Overview

The goal of this lab was to create an end-to-end security operations environment using Microsoft Sentinel as the core SIEM platform combined with SOAR capabilities through automation.

The architecture covers the full lifecycle:

• Data collection from multiple sources
• Detection using custom analytics rules
• Automated response through playbooks
• Integration with ticketing and notification systems

Key Components

1. Data Ingestion Layer

• Resource Group and Log Analytics Workspace
• Microsoft Sentinel enabled on the workspace
• Data Collection Rules (DCR) configured for Windows VMs
• Logs collected from:
• Microsoft Defender XDR
• Entra ID (Azure AD)
• Office 365
• Azure Activity Logs
• On-premises devices via Syslog/CEF

2. Detection Layer

• Custom KQL Analytics Rules created for scheduled log hunting
• Rules automatically generate Incidents when suspicious activity is detected
• Focused on real-world detection scenarios (brute force, anomalous logins, etc.)

3. SOAR & Automation Layer

• Automation Rules in Sentinel configured to trigger on new incidents
• Logic Apps Playbooks used to automate response actions
• Playbooks handle:
• Sending notifications to Teams and Email
• Creating tickets in ServiceNow / Jira
• Automated remediation (Isolate device, Block user account, etc.)

4. Response & Integration

• Direct integration with Microsoft Defender portal
• Analyst investigation workflow
• Automated containment actions

What I Learned

Building this lab gave me practical experience in several important areas:

• Designing proper data collection strategies using Data Collection Rules
• Writing effective KQL queries for threat detection
• Creating automated response workflows using Logic Apps
• Understanding how SIEM and SOAR work together in a real environment
• Integrating security tools with ticketing and collaboration platforms

This project significantly improved my understanding of cloud security operations and Microsoft Sentinel capabilities.

Final Thoughts

Creating this SIEM + SOAR lab from scratch was one of the best hands-on learning experiences I’ve had. It helped me move beyond theory and actually implement a functional security operations pipeline in Azure.

If you’re preparing for Azure security roles or certifications like SC-200, I highly recommend building a similar lab. It’s one of the most effective ways to gain practical skills.

Feel free to ask any questions in the comments — happy to share more details about specific components (DCRs, KQL rules, or Logic Apps playbooks).

Pulkit Rai Azure Security | Building Hands-on Security Labs

Thanks for reading! If you found this useful, please like and share.