Cloud Identity Detection & Response Platform is a full-stack cyber security project that detects identity-based attacks from Microsoft Entra ID / Microsoft 365-style logs.
The platform ingests CSV logs, normalises authentication and audit events, runs detection logic, maps alerts to MITRE ATT&CK, groups alerts into analyst cases, and generates Markdown incident reports.
Identity attacks are a common route into organisations. This project demonstrates practical skills in log analysis, detection engineering, cloud identity security, SOC investigation, and incident response reporting.
- Open the Events page.
- Use the upload controls beside the Events heading to upload a CSV log file.
- The system creates a unique upload batch UUID.
- The uploaded CSV appears as an event batch card.
- Open the batch to view parsed events.
- Run detections against that batch.
- Build cases from the generated alerts.
- Open a case to review the summary, recommendations, status, comments, and report.
- Add analyst comments, update case status, and generate a Markdown incident report.
Each uploaded CSV creates an upload_batch_uuid.
This UUID links:
- uploaded file metadata
- parsed events
- generated alerts
- analyst cases
- case comments
- reports
This keeps separate investigations isolated from each other and avoids mixing events from multiple uploads.
Each detection runs over a batch of normalised events and emits scored, MITRE-mapped alerts.
| Detection | Rule | MITRE | Trigger logic |
|---|---|---|---|
| Password spraying | DET-001 | T1110.003 | One source IP with 20+ failed sign-ins across 10+ distinct users inside a rolling 60 minute window |
| Brute force | DET-002 | T1110 | One source IP with 10+ failed sign-ins against a single user inside a rolling 30 minute window |
| Impossible travel | DET-003 | T1078 | Same user with successful sign-ins from two countries under 2 hours apart |
| MFA fatigue | DET-004 | T1621 | 5+ MFA denials for a user followed by a successful MFA approval |
| Suspicious OAuth consent | DET-005 | T1566 | Consent granted to an app requesting Mail.Read, Files.Read.All or offline_access |
| Suspicious mailbox forwarding | DET-006 | T1114 | New-InboxRule forwarding to a domain outside INTERNAL_DOMAINS |
Detections are not hardcoded. Every rule lives as YAML in detections/, and the engine loads its thresholds, severity and MITRE mapping from that pack at import time, so the YAML is the single source of truth.
- Validate the pack:
cd backend && python ../scripts/validate_rules.py. This also runs in CI and fails the build on a malformed rule. - Publish to Sigma:
cd backend && python ../scripts/export_sigma.pywrites portable Sigma rules tosigma/, tagged to ATT&CK and consumable by any Sigma-compatible SIEM.
- Backend: Python, FastAPI, SQLAlchemy, Pandas
- Database: PostgreSQL
- Frontend: Next.js, TypeScript, Tailwind CSS
- DevOps: Docker Compose
- Testing: Pytest
Case investigation view: grouped alerts, MITRE ATT&CK mapping, severity scoring and recommended response actions. Data shown is synthetic (Microsoft contoso.com demo dataset).
End-to-end pipeline: raw sign-in events ingested, detections run, alerts raised and cases built from a single upload batch.
Alerts view: Detections across brute force, impossible travel, MFA fatigue, OAuth consent, mailbox forwarding and password spray, each mapped to a MITRE technique and scored.
docker compose up --build- CSV log upload
- Event normalisation
- Password spray detection
- Brute force detection
- Impossible travel detection
- MFA fatigue detection
- Suspicious OAuth consent detection
- Suspicious mailbox forwarding detection
- MITRE ATT&CK mapping
- Alert severity scoring
- Analyst case generation
- Markdown report generation
- Frontend dashboard
- Docker Compose deployment
- Pytest detection tests
- YAML detection-as-code rule pack
- Rule schema validation in CI
- Sigma rule export
A password spray attack results in one successful login, followed by suspicious mailbox forwarding. The platform links the events into one investigation case and recommends containment actions.
Synthetic dataset. No live Microsoft tenant integration by default. Response actions are recommendations only.
This project is licensed under the MIT Licence. See the LICENSE file for details.