Home labs & practical projects
Turn identity events into an investigation timeline
A project to do with your own tools, with guidance on what to create and capture.
What you could create
A Microsoft security analyst needs to investigate related identity events without treating every alert as a separate incident.
| Evidence | What to capture |
|---|---|
| Investigation queries and timeline | Show the inputs, scope and decisions behind this record. Queries state their time window and field assumptions. |
| Analyst assessment with evidence gaps | Include the evidence supporting your conclusion. Correlation is not presented as proof of causation or compromise. |
What you'll need
Vendor environment
Use an authorised training workspace with synthetic sign-in events, or prepare equivalent sample rows for a documented query walkthrough. Confirm which data tables are available.
Project record
Keep the working files for investigation queries and timeline and record assumptions as you go.
Current reference material
Use the linked provider resources to verify the features, access terms and version relevant to your project.
Access & cost
Access may require a licence, trial or training subscription. Confirm availability and permitted use before committing; no free tenant is assumed.
Use an authorised training tenant with test identities and synthetic data. If access is unavailable, document the plan and label it untested.
Suggested milestones
- 1
Plan and investigate
Query a specific test identity across a defined time window.
- 2
Develop your approach
Correlate failed sign-ins, successful access and contextual changes.
- 3
Verify and explain
Write an investigation note with confidence, containment options and missing telemetry.
Useful resources
Use these resources to deepen your understanding and check key details.
Review the current provider requirements and relevant subject areas.
Check relevance, platform versions and current access terms.
Find relevant providers and check features, access requirements and costs.
A useful starting point
Use an authorised training workspace with synthetic sign-in events, or prepare equivalent sample rows for a documented query walkthrough. Confirm which data tables are available.
What a good result looks like
- Queries state their time window and field assumptions.
- Correlation is not presented as proof of causation or compromise.
Finish the project
Remove test identities, policies and data, restore the initial configuration, and check trial expiry or renewal settings.
Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.