Section 1: Seconds Matter, Minutes Are Already Gone - Requirements & Problem Understanding

Executive Summary: This section covers the first five minutes of the interview. We decompose the prompt, ask five clarifying questions that each add or remove a subsystem, and turn the answers into functional requirements, ranked non-functional requirements and a reasoned out-of-scope list. Along the way we separate the latency we own (seconds, inside our pipeline) from the latency we don't (minutes, before logs reach us), and introduce the attack on Contoso that serves as the acceptance test for every later section.

The interviewer reads the prompt:

"Design a multi-tenant service that continuously analyzes security telemetry from customers' Azure environments — sign-ins, control-plane activity, network flows — and raises an alert within seconds when it sees an attack in progress: brute force, impossible travel, privilege escalation, lateral movement. Assume tens of thousands of customer tenants and millions of events a second."

It sounds like a log pipeline with some if statements. It is really a race against an attacker who is already inside. The clock that matters is dwell time: the minutes between compromise and an analyst knowing about it, each one a chance to add credentials, grant roles and move sideways. A detection that arrives after the attacker has finished is a forensic report.

Key Insight: Speed is the point of this system, but most of the delay sits outside it. Platform logs already arrive minutes after the event happened. Our job is to add seconds on top of that, never more minutes.

Decomposing the Prompt

Before asking anything, map the territory out loud:

• What flows in: Entra ID sign-in and audit logs, the Azure Activity Log (control-plane writes such as role assignments), NSG and VNet flow logs, other resource diagnostics, and custom sources pushed to us.
• Who uses it: each tenant's SOC analysts triage what we raise; tenant admins enable built-in rules and write their own; we, as operators, keep the fleet alive and prove detection still works.
• Why it exists: to cut dwell time, so detections land while the attack is still unfolding.
• How it's shaped: events stream in, rules evaluate them continuously, and alerts stream out to where a SOC already works: a SIEM such as Microsoft Sentinel, ticketing, chat and playbooks.

The tenant boundary is drawn on purpose: every event belongs to exactly one tenant from edge to alert. Section 8 — Security, Compliance & Governance Architecture explains how.