What problem does it solve? Security learners often struggle to move from reading about SIEM detections to actually writing, deploying, and validating one. This Skill walks a learner through creating a real scheduled analytics rule in Microsoft Sentinel that detects impossible travel sign-ins, including the often-skipped steps of entity mapping, false-positive tuning, and deliberately triggering the rule to prove it works. ## Core Features & Use Cases - KQL Detection Query Construction: Builds an impossible-travel query on SigninLogs using serialize and prev() to compare consecutive sign-ins per user across countries within a 60-minute window. - Scheduled Rule Configuration: Wraps the query in a Sentinel scheduled analytics rule with severity, MITRE tactics, run frequency, lookback window, entity mapping (Account, IP), and alert grouping. - False-Positive Tuning and Live Trigger Test: Adds allowlist exclusions for VPN exit IPs and service accounts, then validates end-to-end by switching VPN countries and confirming an incident is created. - Use Case: A cybersecurity student with a Sentinel workspace wants hands-on detection engineering experience; they follow the five phases to ship a working impossible-travel detection and can explain every design decision. ## Quick Start Ask the Mentor to start the cso-detection-rule project and walk you through writing a Sentinel scheduled analytics rule that detects impossible travel sign-ins.
