Building A SOC + Honeynet in Azure
Building A SOC + Honeynet in Azure
SOC +
Honeynet in
Azure
By odiraonodugo
Edited by www.purplehackademy.com
SOC-Cybersecurity-Project
Introduction
In this project, I build a mini honeynet in Azure and ingest log sources from various
resources into a Log Analytics workspace, which is then used by Microsoft Sentinel to
build attack maps, trigger alerts, and create incidents. I measured some security
metrics in the insecure environment for 24 hours, apply some security controls to
harden the environment, measure metrics for another 24 hours, then show the
results below. The metrics we will show are:
The architecture of the mini honeynet in Azure consists of the following components:
For the "BEFORE" metrics, all resources were originally deployed, exposed to the
internet. The Virtual Machines had both their Network Security Groups and built-in
firewalls wide open, and all other resources are deployed with public endpoints
visible to the Internet; aka, no use for Private Endpoints.
For the "AFTER" metrics, Network Security Groups were hardened by blocking ALL
traffic with the exception of my admin workstation, and all other resources were
protected by their built-in firewalls as well as Private Endpoint
Metric Count
SecurityEvent 28160
Syslog 5023
SecurityAlert 197
SecurityIncident 6
AzureNetworkAnalytics_CL 674
Metric Count
SecurityEvent 11292
Syslog 25
SecurityAlert 0
SecurityIncident 0
AzureNetworkAnalytics_CL 0
SecurityEvent (-98.27%) ,
Syslog (-100%) ,
SecurityAlert (-100%) ,
SecurityIncident (-100%) ,
zureNetworkAnalytics_CL (-100%) ,
Conclusion
In this project, a mini honeynet was constructed in Microsoft Azure and log sources
were integrated into a Log Analytics workspace. Microsoft Sentinel was employed to
trigger alerts and create incidents based on the ingested logs. Additionally, metrics
were measured in the insecure environment before security controls were applied,
and then again after implementing security measures. It is noteworthy that the
number of security events and incidents were drastially reduced after the security
controls were applied, demonstrating their effectiveness.
It is worth noting that if the resources within the network were heavily utilized by
regular users, it is likely that more security events and alerts may have been
generated within the 24-hour period following the implementation of the security
controls.