Microsoft Sentinel Development Environment Setup

Internship Objective 

To provide hands-on experience in cloud-based SIEM (Security Information and Event Management) technologies by designing and deploying a fully independent Microsoft Sentinel instance for development and testing purposes. The environment will support SOC Engineering use cases and enable automation, integration, and CI/CD workflows aligned with internal policies and naming conventions. 

Scope of Work 

1. Environment Setup 

• Deploy a new Microsoft Sentinel instance in a dedicated Azure subscription or resource group, fully isolated from the production environment. 
• Ensure the environment is easy to maintain, scalable, documented and cost-effective. 
• Apply internal naming conventions and policy compliance from the start. 

2. Access Control 

• Implement Role-Based Access Control (RBAC) tailored for SOC Engineering roles. 
• Ensure least privilege principles and auditability. 

3. Integration with Existing Infrastructure 

• Connect the Sentinel instance to an existing Logstash server in the development environment. 
• Validate data ingestion and parsing using custom schemas if needed. 

4. Playbooks and Automation 

• Develop and test Log Analytics playbooks for common SOC use cases (e.g., alert enrichment, incident tagging). 
• Create automation playbooks using: 
  • Azure Logic Apps for workflow orchestration. 
  • Azure Function Apps for custom logic and lightweight automation. 

5. CI/CD and Content Management 

• Set up CI/CD pipelines using GitHub or Azure DevOps to manage: 
  • Sentinel analytics rules 
  • Workbooks 
  • Playbooks 
  • Function App code 
• Ensure version control, peer review workflows, and automated deployment to the dev Sentinel instance. 

Deliverables 

• Fully operational Microsoft Sentinel dev instance. 
• Documented RBAC model and access policies. 
• Working integration with Logstash. 
• At least 3 Log Analytics playbooks and 2 automation playbooks. 
• CI/CD pipeline with sample content deployment. 
• Final report and presentation summarizing the setup, challenges, and learnings. 

Candidate Profile 

• Bachelor student in CyberSecurity or related field. 
• Familiarity with Azure, SIEM concepts, and scripting (PowerShell, Python). 
• Interest in SOC operations and automation. 

Duration 

8–12 weeks, full-time or part-time depending on academic schedule. 

Mentorship & Support 

Supervision by SOC Engineering team.

Bachelor's program/required background: Computer Science, Cybersecurity

Language requirements: English

Type of Project: Internship

Mentor: Andy Wouters 

For more information or application, please contact the sypervising scientist Andy Wouters (andy.wouters@imec.be).