Tarun Teja Desireddy
Senior Cybersecurity Analyst & Security Engineer
I investigate incidents and build what catches the next one.
About
Most of my week is incident work. I take the alert, run the investigation down to root cause, and keep the serious cases moving before they breach SLA. The detections firing those alerts are mine too. I write them in KQL and map each to an ATT&CK technique, so it stays clear what we cover and what we don't. Hypothesis-driven hunt packages build on the same mapping. Tuning a noisy rule matters as much as writing a new one.
The platform underneath is Microsoft Sentinel, built as infrastructure-as-code. New log sources and data connectors come online as coverage grows, threat intelligence feeds in through APIs, and SOAR playbooks handle the high-fidelity alerts.
This runs across the rest of the Microsoft security stack. I review identity activity in Microsoft Entra ID and posture in Microsoft Defender for Cloud. Automation identities stay on least-privilege RBAC, and network and workload context feeds back into how detections get written. The Azure work is grounded in AZ-500, SC-200, and SC-300. Google SecOps and LogRhythm keep me working outside a single vendor, along with a Google Cloud security operations certification.
Focus Security Operations · Threat Detection · Incident Response · Detection Engineering · Azure Security · Security Automation
View résuméExperience
Jan 2024 to PresentDoha, Qatar · Onsite SOC Engineer · Mannai Technologies (Microsoft Hub)
Security engineering and threat hunting for a Microsoft-partner team that runs a 24/7 managed SOC on Azure and Microsoft Sentinel.
- Deploy and configure Microsoft Sentinel workspaces, and onboard log sources and data connectors as new coverage comes online
- Author and tune KQL analytics rules, each mapped to a MITRE ATT&CK technique, and bring external threat-intelligence feeds in through Sentinel's ingestion APIs
- Run proactive, hypothesis-driven threat hunts in KQL, with hunt packages mapped across the MITRE ATT&CK matrix
- Build the SOAR layer: Logic App playbooks, Sentinel automation rules, and Azure Automation runbooks for enrichment, notification, and response, all authenticated by a Key Vault-backed managed identity
- Operate across three SIEMs: Microsoft Sentinel, Google SecOps (Chronicle), and LogRhythm
- Investigate across Azure workloads and identity using Microsoft Defender for Cloud, Microsoft Entra ID, Azure Monitor, and Log Analytics
- Own incident response on the high-severity cases: triage, root-cause analysis, SLA tracking, and Sentinel workbooks for operational reporting
- Microsoft Sentinel
- KQL
- Microsoft Entra ID
- Defender for Cloud
- Logic Apps
- Azure Automation
- MITRE ATT&CK
- Google SecOps
- LogRhythm
Oct 2022 to Jan 2024Remote · India Security Consultant, Tier 1 SOC · Mannai Technologies (Microsoft Hub)
Tier 1 SOC on Mannai's Microsoft-partner managed service, payrolled through MGS Technology. I worked the Microsoft Sentinel queue and took each alert from first review to a documented outcome.
- Monitored and investigated security alerts and incidents in Microsoft Sentinel on a 24/7 SOC rotation
- Performed initial triage to determine each incident's severity, impact, and business risk
- Investigated alerts using Sentinel investigation graphs, entities, incidents, and Log Analytics
- Wrote KQL to search and correlate events across Microsoft Defender, Entra ID, Windows Event Logs, Azure Activity logs, and firewall data
- Investigated phishing, brute-force, impossible-travel, malware, suspicious sign-in, and unauthorized-access alerts
- Analysed suspicious IPs, URLs, domains, and file hashes with VirusTotal, AbuseIPDB, WHOIS, and threat-intelligence platforms
- Followed SOC runbooks and SOPs, and recorded the investigation, actions taken, and recommendations in each incident ticket
- Ran basic threat hunts in KQL, mapped findings to MITRE ATT&CK, and fed false-positive patterns back into detection tuning while keeping to SLA
- Microsoft Sentinel
- KQL
- Microsoft Defender
- Microsoft Entra ID
- Windows Event Logs
- MITRE ATT&CK
- VirusTotal
- AbuseIPDB
- WHOIS
- Threat intelligence
Skills
Security Architecture & Cloud Posture
AZ-500 covers the whole Azure security surface, and that's the lens I work from. I review posture in Microsoft Defender for Cloud and investigate across workloads through Azure Monitor and Log Analytics. Most of the judgment is about resource scope, RBAC inheritance, and what's genuinely exposed.
- Defender for Cloud
- Azure Monitor
- Log Analytics
- Secure-by-design
Identity & Access
Identity is the control plane every other control inherits from. I investigate sign-in and identity activity in Microsoft Entra ID, think through RBAC scope and inheritance when something looks off, and keep automation identities down to least privilege.
- Microsoft Entra ID
- Azure RBAC
- Least privilege
- Identity investigation
Sentinel Engineering & Onboarding
I stand up Microsoft Sentinel workspaces from code rather than the portal, and bringing new log sources and data connectors online is routine work. External threat intelligence and automation get wired in over their APIs.
- Sentinel as code
- Log source onboarding
- Data connectors
- API integration
Detection Engineering
I write detections in KQL and map each one to an ATT&CK technique, so it stays clear what's covered and what isn't. The published library sits at 38 rules. Tuning an existing rule for signal matters as much as writing a new one.
- KQL
- Analytics rules
- Detection tuning
- MITRE ATT&CK
Threat Hunting
The hunting is hypothesis-driven and runs in KQL. I package each hunt so it can be re-run later and map it to the ATT&CK techniques it covers. What I go looking for comes out of threat intelligence and IOC enrichment.
- Hypothesis-driven
- KQL hunting
- Hunt packages
- MITRE ATT&CK
Security Automation & Incident Response
My playbooks and runbooks run on Logic Apps and Azure Automation, with Sentinel automation rules tying them to incidents. They authenticate through a Key Vault-backed managed identity, so no secrets sit in code. When a real incident comes in, I take the triage, get to root cause, watch the SLA clock, and pull people together on the high-severity ones.
- Logic Apps
- Automation rules
- Azure Automation
- Incident response
Microsoft certifications
- SC-200Security Operations Analyst Associate
- SC-300Identity and Access Administrator Associate
- AZ-500Azure Security Engineer Associate
Projects
Internet-facing SSH honeypot → Microsoft Sentinel
An SSH honeypot disguised as a finance-database server, wired into Sentinel through a CEF pipeline. I built it to get genuine attacker telemetry for detection engineering.
- Azure VM
- nftables
- Suricata
- Cowrie
- CEF
- Microsoft Sentinel
38 ATT&CK-mapped analytics rules
Every rule is written for a small, quiet tenant and mapped to a tactic. Cadence and grouping are tuned so the output is signal, not a queue of duplicates.
- Microsoft Sentinel
- KQL
- MITRE ATT&CK
- Analytics rules
- Entity mapping
Threat Radar: a live CTI dashboard at the edge
A static site can't fetch cross-origin threat feeds. An edge worker does it server-side and caches the result, so the upstreams get hit twice an hour no matter the traffic.
- Cloudflare Pages Functions
- Next.js (static export)
- TypeScript
- CISA KEV
- ransomware.live
- RSS
Writing
2026 Working incidents in Microsoft Sentinel
The incident object, its lifecycle and classifications, how entities make it investigable, the KQL to measure the queue, and the two API surfaces that write to it. One of them carries an ID trap that silently corrupts automation.
Microsoft Sentinel · 10 min read · Practitioner
2026 Ports & port numbers
What a port actually is, how TCP and UDP differ, and which ports matter to an attacker and to a defender at each stage of an intrusion.
Networking & Packet Analysis · 16 min read · Beginner
2026 Wireshark for the SOC
How to read a capture file the way an analyst does: the walkthrough from capture to written finding, the display filters by protocol, the attack patterns to recognise, and what still leaks once traffic is encrypted.
Networking & Packet Analysis · 22 min read · Practitioner