The problem.
Sentinel ingestion is expensive. I wanted an alternative for SOC search and dashboards on Entra ID logs, and reusable Microsoft 365 detections for an open-source SIEM.
What I built.
01
Splunk
- Entra ID diagnostic settings to Event Hub, ingestion through the Microsoft Cloud Services add-on, dedicated index, SOC dashboards.
- Microsoft Graph inventory collectors and import of Defender alerts and incidents.
02
Wazuh
- Microsoft 365 dashboards and detections: sign-ins, MFA, privileged access, mail forwarding, DLP, Teams and OneDrive sharing, guests, SharePoint and OneDrive admin activity.
The architecture.
Entra IDdiagnostic settings
Event HubAzure
Splunkentra index
WazuhM365 detections
SOC dashboards
Security & guardrails.
- Local containerised stack, secrets kept out of the repository.
The results.
- Two working collection pipelines and ready-to-import detections.
