Deployed a cloud-native SIEM integrating Microsoft Azure infrastructure, Windows endpoints, Microsoft 365, and Defender XDR telemetry into a unified detection and response platform.

Wrote KQL analytics rules for real-time threat detection covering: privilege escalation, suspicious PowerShell execution, lateral movement via RDP and SMB, anomalous Azure AD sign-ins, and malware execution patterns. Automated incident response using Azure Logic Apps.

Reduced log ingestion costs by 20% through optimised data collection, balancing coverage against cost without losing detection fidelity.

Published full write-up on Medium: medium.com/@babsib2dk