Detection engineering
A safe coordination hub and local analyst workbench connecting Windows, Microsoft Entra, and Microsoft Sentinel detection labs through synthetic evidence.
Detection engineering, lab coordination, and documentation
2026
Public hub · synthetic training environment
Python · KQL · Sigma · PowerShell
Identity detections are easier to understand when endpoint authentication, cloud sign-in, and SIEM correlation can be reviewed as one path. The individual labs needed a common entry point without duplicating their evidence or introducing production data.
I built the public coordination layer, validation commands, portable Windows helpers, and a local workbench that turns synthetic events into alerts, incidents, analyst notes, guided training, and exportable evidence.
The static hub links each lab's demo, documentation, repository, and release. A separate local Python workbench stores synthetic activity in SQLite, evaluates detection logic as events arrive, and supports both free analysis and guided SOC-style case journeys.
Three specialized evidence layers feed a coordination hub and an optional local analyst workflow.
Endpoint authentication signals
Cloud identity signals
Cross-source correlation
Incidents, notes, training, exports
The hub links the full evidence chain: public demos, GitBook documentation, releases, and the coordinated repository.