Building a Cloud SOC for Startups in Azure: 25s Threat Detection & Full Disaster Recovery Drill

In this live technical demonstration and B.Sc. Cybersecurity capstone walkthrough, we deploy, test, and validate an enterprise-grade, cloud-native Incident Response and Disaster Recovery (IR/DR) framework using Microsoft Azure. Designed specifically for lean regional enterprises and tech startups, this framework aligns with the NIST SP 800-61r2 incident handling lifecycle to eliminate costly on-premises hardware while maintaining verifiable cyber resilience. 🚀 Key Empirical Benchmarks: • Mean Time to Detect (MTTD): 25 Seconds (11:53:50 – 11:54:15) • Mean Time to Respond (MTTR): 4 Minutes 55 Seconds (11:55:13 – 12:00:08) • Recovery Point Objective (RPO): 32 Minutes 20 Seconds (12:34:52 – 1:07:12) • Recovery Time Objective (RTO): 77 Minutes (Catastrophic VM wipe to full operational recovery) ⏱️ TIMESTAMPS: 00:00 - Introduction & Project Problem Statement 01:15 - Cloud Architecture in Azure (South Africa North) 02:30 - NIST Preparation: Windows Server 2022 Core & Log Ingestion 10:33 - NIST Detect: RDP Brute-Force Attack & KQL Ingestion (25s MTTD) 19:40 - NIST Respond: Incident Triage & Dynamic NSG Isolation (4m 55s MTTR) 21:50 - NIST Recover: Ransomware Simulation & Disaster Recovery Drill 22:40 - The Staging Storage Gotcha & Key Engineering Takeaways 24:30 - Summary, Empirical Results & Conclusion 🛠️ System Environment & Specifications: • Workload: App-server-01 (Standard D2s_v3, 2 vCPUs, 8 GiB RAM, x64) • Operating System: Windows Server 2022 Datacenter: Azure Edition Core • Cloud Region: South Africa North • Core Services: Microsoft Sentinel, Microsoft Defender XDR, Azure Monitor Agent, Network Security Groups, Azure Recovery Services Vault 🛡️ PowerShell Network Containment Rule: $ResourceGroupName = "RG-Regional-Workloads-Prod" $NSGName = "nsg-appserver-sn-01" $RuleName = "BLOCK-MALICIOUS-IP-INCIDENT-IR-497" $AttackerIP = "197.210.64.12" 📌 Key Engineering Lessons Learned: Unified Security Operations RBAC: Bidirectional alert correlation between Sentinel and Defender XDR requires explicit assignment of both Microsoft Sentinel Contributor and Security Admin roles. Regional Staging Dependencies: Azure VM restores will stall if the intermediate staging storage account is not located within the exact same geographic region (South Africa North) as the Recovery Services Vault. #Cybersecurity #MicrosoftAzure #MicrosoftSentinel #IncidentResponse #DisasterRecovery #CloudSecurity #NIST #BlueTeam #SOC #AzureSecurity