A personal lab for detection engineering on Microsoft Sentinel and Defender XDR: everyday SOC tools, tested scripts and lab experiments. Free, open, and nothing to sign up for.
SigninLogs | where TimeGenerated > ago(1h) | where ResultType in ("50126", "50053") | summarize Failures = count(), Users = dcount(UserPrincipalName) by IPAddress | where Users > 15 and Failures > 40 // tuned
Each one started as something done by hand too many times. Free to use, nothing to sign up for.
Browser tools for SOC work. Everything runs locally; nothing is uploaded.
Copy-and-run Bash and PowerShell for Linux, Windows, Sentinel and firewalls, with options you fill in before copying.
Four areas, one goal: an analyst should only see an alert when it's worth their time.
Analytics rules written, tuned and mapped to MITRE ATT&CK, with false-positive budgets and test cases behind every one.
Onboarding and shaping the data first: FortiGate and Palo Alto firewalls over CEF/Syslog via AMA, Arc-connected servers, DCR transforms, and ingestion cost under control.
Playbooks and API-driven enrichment that close the easy incidents automatically and hand analysts a head start on the rest.
Controlled attack simulations that prove a detection fires, plus research that turns new attacker techniques into rules.
Example Sentinel workbooks: SOC posture, firewall telemetry from FortiGate and Palo Alto, and identity risk. Synthetic data.
Pick a scenario. Each one walks from raw events to a correlated incident using synthetic data only.
NoxCipher is an independent lab for detection engineering on Microsoft Sentinel, Defender XDR and Entra ID: the tools and notes that make alert triage faster. No services, no tracking, no ads.