Microsoft Entra Detection Mini-SOC

Guided walkthrough for synthetic Microsoft Entra ID sign-in and audit detections.

Synthetic lab only. No real tenants, credentials, tokens, production logs or live Graph calls.

For reviewers: 3-minute guided pathStart with ENTRA-003-POS, inspect the matched fields, open the GitBook playbook, then compare with the validation report.
Detections
Synthetic cases
Expected alerts
Tuning cases
Pass rate

Log sourceThresholdSeverity reasonMatched fieldsPlaybook

Analyst narrative

Event timeline

TimeSourceUser/ActorIPApplication/ActivityStatus/ResultFields