0.6 Lab Setup: Sample Data and Validation

Figure — Lab Setup: Sample Data and Validation. Applied to security operations at Northgate Engineering.

Lab Setup: Sample Data and Validation

A lab environment with 6 test users and no activity generates minimal security data. To practice the investigation techniques in this course, you need realistic data. This subsection shows you how to generate it.

Generating sign-in data

The simplest way to populate your SigninLogs and AADNonInteractiveUserSignInLogs tables is to sign in as your test users.

Step 1: Open an InPrivate/Incognito browser window.

Step 2: Navigate to portal.office.com and sign in as j.morrison@yourdomain.onmicrosoft.com.

Installing the Microsoft 365 sample data packs

If you used the Instant Sandbox (Option 1), sample data is pre-installed. For Options 2 and 3, you can install sample data packs from the Developer Program dashboard, but this requires Developer Program membership.

Alternatively, generate your own:

Email data: Send 20-30 test emails between your users over several days. Include emails with links (to generate EmailUrlInfo data), emails with attachments (to generate EmailAttachmentInfo data), and external emails from your personal account (to generate external sender patterns).

Process data: If you onboard a device to Defender for Endpoint (covered in Module 4), every application you open, every PowerShell command you run, and every network connection generates DeviceProcessEvents and DeviceNetworkEvents. For lab purposes, a single Windows VM or your own workstation onboarded to the developer tenant provides rich data.

Content Hub solutions

Sentinel Content Hub provides pre-built detection rules, workbooks, and playbooks that populate your workspace with useful configurations.

Step 1: In Sentinel, navigate to Content management → Content Hub.

Step 2: Install these solutions (click each → Install):

• Microsoft 365 — provides analytics rules for M365 threats
• Microsoft Entra ID — provides sign-in analytics and workbooks
• Microsoft Defender XDR — provides incident correlation rules
• UEBA Essentials — provides behavioral analytics

These do not generate data, but they give you pre-built analytics rules and workbooks that you will explore and modify in Modules 7 and 9.

Final validation

Run these queries to confirm your lab environment is ready:

Check available tables:

search *
| where TimeGenerated > ago(7d)
| summarize EventCount = count(), LastEvent = max(TimeGenerated) by Type
| where EventCount > 0
| sort by EventCount desc

SigninLogs
| where TimeGenerated > ago(7d)
| take 5
| project TimeGenerated, UserPrincipalName, IPAddress, Location, ResultType

EmailEvents
| where TimeGenerated > ago(7d)
| take 5
| project TimeGenerated, SenderFromAddress, RecipientEmailAddress, Subject, DeliveryAction

Environment summary

At this point, your lab environment includes:

You are ready for Module 1. Every hands-on exercise in the course builds on this environment.

Detection depth: NE-specific implementation

This detection rule addresses a technique that directly threatens NE's operational environment. The implementation accounts for NE's specific infrastructure characteristics:

Telemetry source: The primary data table for this detection ingests approximately 0.5-3.2 GB/day depending on the activity volume. At NE's scale (810 users, 865 devices, 42 servers), the event volume generates a stable baseline that statistical detection methods (percentile analysis from DE9.4) can reliably characterize. Deviations from this baseline represent either environmental changes (new applications, infrastructure modifications) or attacker activity.

Threshold calibration: The threshold was selected using the percentile method: P99 of 30-day historical data establishes the upper bound of normal activity. The production threshold is set at 1.5x P99 to provide margin above normal fluctuation while maintaining detection sensitivity for attack patterns that typically generate 5-50x normal volume.

Validating the data pipeline

After loading sample data and enabling connectors, validate that data is flowing correctly before starting Module 1. Run these three verification queries in the Sentinel Logs blade:

The first query checks that sign-in data is present: query SigninLogs with a count for the last 24 hours. If the result is zero, the Entra ID connector is not configured correctly or has not had time to ingest (allow 15-30 minutes after connector enablement).

The second query checks device data: query DeviceProcessEvents for the last 24 hours. This table requires Defender for Endpoint onboarding — if no devices are onboarded in the developer tenant, this table will be empty. Onboard at least one device (a test VM or your workstation connected to the developer tenant) to populate this table.

Synthetic data limitations

Sample data packs provide realistic-looking user accounts, email activity, and device events. They do not provide: realistic alert volumes (sample environments generate fewer alerts than production), realistic baseline patterns (800 synthetic users do not behave like 800 real employees), or realistic false positive ratios (sample data is cleaner than production data). These limitations mean that detection rules tuned in the lab environment will require re-tuning when deployed to production.

The NE lab data — available as an alternative through the data generator in tools/lab-data-generator — addresses these limitations by providing 90 days of statistically realistic security data with embedded attack chains. The interactive labs embedded in each module provide the third option: practice investigation and triage decisions directly in the browser without any external data source. All three approaches work. The course content shows the query and the expected output regardless of which data source you use.

The three data paths

This course supports three data paths, each with trade-offs:

Path 1 — Interactive labs (zero setup). The embedded labs in each module provide scenario-based practice directly in your browser. Parameter sandboxes let you tune detection thresholds. Alert simulators present triage queues. Investigation engines walk you through multi-step investigations. This path requires no external environment and is sufficient to complete the course.

Path 2 — Developer tenant with sample data (30 minutes setup). The M365 E5 developer tenant with sample data packs provides a full Sentinel workspace where you can write and execute queries. The data is synthetic but structurally identical to production data. This path provides the query execution experience — you write KQL and see results.