# Enhancing Cloud Security--Proactive Threat Monitoring and Detection Using a SIEM-Based Approach
## 4 Results and Discussions
### SIEM Solution  
The employed SIEM system analytics allow a security analyst to identify recurring incidents and uncommon trends that would otherwise go un-noticed. The incident page is the entry point for an analyst to consume security incidents (tickets) in Sentinel, and Figure 7 illustrates the deployed SIEM incident status page.  
This page offers visibility into all entities involved in an alert and presents a user-friendly interface (UI) for investigating the detections, allowing analysts to swiftly grasp the scope of a breach. The investigation graph showcased in Figure 8 enables the correlation of relevant data with the associated entities, facilitating a deeper understanding and determination of the potential security threat's root cause. The Timeline tab facilitates analysts to scrutinize the chronological sequence of alerts within an incident, thereby enabling them to reconstruct the sequence of attack activities with precision and depth. Meanwhile, in the Entities tab, analysts can explore all the entities mapped as per the defined alert rule. It offers a comprehensive overview of the diverse objects implicated in the incident, ranging from users and devices to addresses and files, among others.  
Working with Microsoft Sentinel workbooks provides quantified graphical data representation and allows for the creation of interactive reports that can enhance security analysts' ability to see beneath the surface of what is going on in the cloud. Figure 9 presents data collection and health monitoring, identity and access, and threats intelligence in the log analytics workspace workbooks. The dashboard and visual representations are very useful in the world of security operations to show trends and anomalies in day-to-day security events. Without such analytics capabilities in place, the ability of security analysts would be limited in scope and effectiveness.  
Figure 7: SIEM incident status page.  
The analysis of the Data Health and Monitoring workbook revealed valuable insights into critical metrics, such as ingestion size, latency, logs per source, and the identification of data collection anomalies. Figure 9a demonstrates how events were categorized into tables based on activated log types, including security events, Syslog, Azure metrics,  
Figure 8: Investigation graph.  
Figure 9: Performance of data collection and health monitoring (**a**), identity and access (**b**), threats intelligence (**c**)—Log analytics workspace workbooks.  
Azure diagnostics, and more. The workbook helps ensure seamless and uninterrupted data ingestion into the log analytics workspace. Moreover, the Identity and Access workbook (Figure 9b) provided a comprehensive view of users and connected device activities within the Azure Active Directory. It enabled the analysis of identity and access events, including sign-in events, audit events, and risky users. The visualizations and metrics presented in this workbook proved instrumental in understanding user behaviors and identifying potential security issues.  
Additionally, the Threat Intelligence workbook (Figure 9c) played a vital role in the identification and response to threats. By leveraging indicators of compromise (IOCs) such as IP addresses, domains, URLs, and email addresses, it facilitated threat hunting across cloud workloads. The workbook's analysis capabilities allow a deeper understanding of observed threats, including their associated threat groups, targeted assets, tactics, techniques, and procedures (TTPs).