Skip to content

Commit 1dfae76

Browse files
author
Andreas Kapetaniou
committed
Add Microsoft Sentinel Training Lab to Tools
Standalone training lab solution with: - ARM template deployment (workspace, automation, ingestion pipeline) - 14 hands-on exercises (MDTI, MITRE, automation, MCP, notebooks, etc.) - Per-file CSV download with dynamic discovery via GitHub API - CrowdStrike, Okta, AWS CloudTrail, GCP Audit Logs telemetry - Detection rules deployment via Microsoft Graph API - Workbook, playbook, watchlists, analytic and hunting rules - Tools/Ingest-LocalCSV.ps1 standalone ingestion utility
1 parent 3447dde commit 1dfae76

File tree

95 files changed

+106480
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

95 files changed

+106480
-0
lines changed

‎Tools/Microsoft-Sentinel-Training-Lab/Artifacts/DetectionRules/rules.json‎

Lines changed: 463 additions & 0 deletions
Large diffs are not rendered by default.

‎Tools/Microsoft-Sentinel-Training-Lab/Artifacts/LinkedTemplates/WorkspaceLakeUsage-ARM.json‎

Lines changed: 44 additions & 0 deletions
Large diffs are not rendered by default.

‎Tools/Microsoft-Sentinel-Training-Lab/Artifacts/LinkedTemplates/alertRules.json‎

Lines changed: 320 additions & 0 deletions
Large diffs are not rendered by default.

‎Tools/Microsoft-Sentinel-Training-Lab/Artifacts/LinkedTemplates/deployDetectionRules.json‎

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
{
2+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
3+
"contentVersion": "1.0.0.0",
4+
"parameters": {
5+
"scheduleStartTime": {
6+
"type": "string",
7+
"metadata": {
8+
"description": "UTC start time for the one-time detection-rules schedule (should run before data ingestion)"
9+
}
10+
},
11+
"userAssignedIdentityResourceId": {
12+
"type": "string",
13+
"defaultValue": "",
14+
"metadata": {
15+
"description": "Full resource ID of a pre-created User-Assigned Managed Identity that has been granted the Microsoft Graph CustomDetection.ReadWrite.All application permission. Required when using Managed Identity auth (leave SPN params empty)."
16+
}
17+
},
18+
"spnTenantId": {
19+
"type": "string",
20+
"defaultValue": "",
21+
"metadata": {
22+
"description": "Microsoft Entra tenant ID for service principal authentication. Provide together with spnClientId and spnClientSecret to use SPN auth instead of Managed Identity."
23+
}
24+
},
25+
"spnClientId": {
26+
"type": "string",
27+
"defaultValue": "",
28+
"metadata": {
29+
"description": "Application (client) ID of the service principal with CustomDetection.ReadWrite.All permission."
30+
}
31+
},
32+
"spnClientSecret": {
33+
"type": "securestring",
34+
"defaultValue": "",
35+
"metadata": {
36+
"description": "Client secret of the service principal."
37+
}
38+
}
39+
},
40+
"variables": {
41+
"automationAccountName": "[concat('sentineldetections', uniqueString(resourceGroup().id))]",
42+
"runbookName": "DeployDetectionRules",
43+
"scheduleName": "[concat('DeployDetectionRulesOnce-', uniqueString(resourceGroup().id, parameters('scheduleStartTime')))]",
44+
"useSpn": "[and(not(empty(parameters('spnTenantId'))), not(empty(parameters('spnClientId'))), not(empty(parameters('spnClientSecret'))))]",
45+
"useManagedIdentity": "[and(not(variables('useSpn')), not(empty(parameters('userAssignedIdentityResourceId'))))]"
46+
},
47+
"resources": [
48+
{
49+
"condition": "[variables('useManagedIdentity')]",
50+
"type": "Microsoft.Automation/automationAccounts",
51+
"apiVersion": "2023-11-01",
52+
"name": "[variables('automationAccountName')]",
53+
"location": "[resourceGroup().location]",
54+
"identity": {
55+
"type": "UserAssigned",
56+
"userAssignedIdentities": {
57+
"[if(variables('useManagedIdentity'), parameters('userAssignedIdentityResourceId'), 'placeholder')]": {}
58+
}
59+
},
60+
"properties": {
61+
"sku": {
62+
"name": "Basic"
63+
}
64+
}
65+
},
66+
{
67+
"condition": "[variables('useSpn')]",
68+
"type": "Microsoft.Automation/automationAccounts",
69+
"apiVersion": "2023-11-01",
70+
"name": "[variables('automationAccountName')]",
71+
"location": "[resourceGroup().location]",
72+
"properties": {
73+
"sku": {
74+
"name": "Basic"
75+
}
76+
}
77+
},
78+
{
79+
"type": "Microsoft.Automation/automationAccounts/runbooks",
80+
"apiVersion": "2023-11-01",
81+
"name": "[concat(variables('automationAccountName'), '/', variables('runbookName'))]",
82+
"location": "[resourceGroup().location]",
83+
"dependsOn": [
84+
"[resourceId('Microsoft.Automation/automationAccounts', variables('automationAccountName'))]"
85+
],
86+
"properties": {
87+
"runbookType": "PowerShell",
88+
"logProgress": true,
89+
"logVerbose": true,
90+
"publishContentLink": {
91+
"uri": "[concat('https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Tools/Microsoft-Sentinel-Training-Lab/Artifacts/Scripts/DeployDetectionRules.ps1', '?v=', parameters('scheduleStartTime'))]"
92+
}
93+
}
94+
},
95+
{
96+
"type": "Microsoft.Automation/automationAccounts/schedules",
97+
"apiVersion": "2023-11-01",
98+
"name": "[concat(variables('automationAccountName'), '/', variables('scheduleName'))]",
99+
"dependsOn": [
100+
"[resourceId('Microsoft.Automation/automationAccounts', variables('automationAccountName'))]"
101+
],
102+
"properties": {
103+
"frequency": "OneTime",
104+
"startTime": "[parameters('scheduleStartTime')]",
105+
"timeZone": "UTC"
106+
}
107+
},
108+
{
109+
"condition": "[variables('useManagedIdentity')]",
110+
"type": "Microsoft.Automation/automationAccounts/variables",
111+
"apiVersion": "2023-11-01",
112+
"name": "[concat(variables('automationAccountName'), '/DetectionRulesManagedIdentityClientId')]",
113+
"dependsOn": [
114+
"[resourceId('Microsoft.Automation/automationAccounts', variables('automationAccountName'))]"
115+
],
116+
"properties": {
117+
"isEncrypted": false,
118+
"value": "[if(variables('useManagedIdentity'), concat('\"', reference(parameters('userAssignedIdentityResourceId'), '2023-01-31').clientId, '\"'), '\"\"')]"
119+
}
120+
},
121+
{
122+
"condition": "[variables('useSpn')]",
123+
"type": "Microsoft.Automation/automationAccounts/variables",
124+
"apiVersion": "2023-11-01",
125+
"name": "[concat(variables('automationAccountName'), '/DetectionRulesTenantId')]",
126+
"dependsOn": [
127+
"[resourceId('Microsoft.Automation/automationAccounts', variables('automationAccountName'))]"
128+
],
129+
"properties": {
130+
"isEncrypted": false,
131+
"value": "[concat('\"', parameters('spnTenantId'), '\"')]"
132+
}
133+
},
134+
{
135+
"condition": "[variables('useSpn')]",
136+
"type": "Microsoft.Automation/automationAccounts/variables",
137+
"apiVersion": "2023-11-01",
138+
"name": "[concat(variables('automationAccountName'), '/DetectionRulesClientId')]",
139+
"dependsOn": [
140+
"[resourceId('Microsoft.Automation/automationAccounts', variables('automationAccountName'))]"
141+
],
142+
"properties": {
143+
"isEncrypted": false,
144+
"value": "[concat('\"', parameters('spnClientId'), '\"')]"
145+
}
146+
},
147+
{
148+
"condition": "[variables('useSpn')]",
149+
"type": "Microsoft.Automation/automationAccounts/variables",
150+
"apiVersion": "2023-11-01",
151+
"name": "[concat(variables('automationAccountName'), '/DetectionRulesClientSecret')]",
152+
"dependsOn": [
153+
"[resourceId('Microsoft.Automation/automationAccounts', variables('automationAccountName'))]"
154+
],
155+
"properties": {
156+
"isEncrypted": true,
157+
"value": "[concat('\"', parameters('spnClientSecret'), '\"')]"
158+
}
159+
},
160+
{
161+
"type": "Microsoft.Automation/automationAccounts/jobSchedules",
162+
"apiVersion": "2023-11-01",
163+
"name": "[concat(variables('automationAccountName'), '/', guid(variables('automationAccountName'), variables('runbookName'), variables('scheduleName')))]",
164+
"dependsOn": [
165+
"[resourceId('Microsoft.Automation/automationAccounts/runbooks', variables('automationAccountName'), variables('runbookName'))]",
166+
"[resourceId('Microsoft.Automation/automationAccounts/schedules', variables('automationAccountName'), variables('scheduleName'))]"
167+
],
168+
"properties": {
169+
"runbook": {
170+
"name": "[variables('runbookName')]"
171+
},
172+
"schedule": {
173+
"name": "[variables('scheduleName')]"
174+
}
175+
}
176+
}
177+
],
178+
"outputs": {}
179+
}

‎Tools/Microsoft-Sentinel-Training-Lab/Artifacts/LinkedTemplates/ingestEvents.json‎

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
{
2+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
3+
"contentVersion": "1.0.0.0",
4+
"parameters": {
5+
"WorkspaceName": {
6+
"type": "string",
7+
"metadata": {
8+
"description": "Log Analytics workspace name"
9+
}
10+
},
11+
"scheduleStartTime": {
12+
"type": "string",
13+
"metadata": {
14+
"description": "UTC start time for the one-time schedule"
15+
}
16+
},
17+
"location": {
18+
"type": "string",
19+
"defaultValue": "[resourceGroup().location]",
20+
"metadata": {
21+
"description": "Location for the resources"
22+
}
23+
}
24+
},
25+
"functions": [],
26+
"variables": {
27+
"automationAccountName": "[concat('sentineltraining', uniqueString(resourceGroup().id))]",
28+
"runbookName": "IngestTrainingTelemetry",
29+
"scheduleName": "IngestTrainingTelemetryOnce"
30+
},
31+
"resources": [
32+
{
33+
"type": "Microsoft.Automation/automationAccounts",
34+
"apiVersion": "2024-10-23",
35+
"name": "[variables('automationAccountName')]",
36+
"location": "[parameters('location')]",
37+
"identity": {
38+
"type": "SystemAssigned"
39+
},
40+
"properties": {
41+
"sku": {
42+
"name": "Basic"
43+
}
44+
}
45+
},
46+
{
47+
"type": "Microsoft.Automation/automationAccounts/runbooks",
48+
"apiVersion": "2024-10-23",
49+
"name": "[concat(variables('automationAccountName'), '/', variables('runbookName'))]",
50+
"location": "[parameters('location')]",
51+
"dependsOn": [
52+
"[resourceId('Microsoft.Automation/automationAccounts', variables('automationAccountName'))]"
53+
],
54+
"properties": {
55+
"runbookType": "PowerShell",
56+
"logProgress": true,
57+
"logVerbose": true,
58+
"publishContentLink": {
59+
"uri": "[concat('https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Tools/Microsoft-Sentinel-Training-Lab/Artifacts/Scripts/RunIngest.ps1', '?v=', parameters('scheduleStartTime'))]"
60+
}
61+
}
62+
},
63+
{
64+
"type": "Microsoft.Automation/automationAccounts/schedules",
65+
"apiVersion": "2024-10-23",
66+
"name": "[concat(variables('automationAccountName'), '/', variables('scheduleName'))]",
67+
"dependsOn": [
68+
"[resourceId('Microsoft.Automation/automationAccounts', variables('automationAccountName'))]"
69+
],
70+
"properties": {
71+
"frequency": "OneTime",
72+
"startTime": "[parameters('scheduleStartTime')]",
73+
"timeZone": "UTC"
74+
}
75+
},
76+
{
77+
"type": "Microsoft.Automation/automationAccounts/variables",
78+
"apiVersion": "2024-10-23",
79+
"name": "[concat(variables('automationAccountName'), '/SentinelTrainingSubscriptionId')]",
80+
"dependsOn": [
81+
"[resourceId('Microsoft.Automation/automationAccounts', variables('automationAccountName'))]"
82+
],
83+
"properties": {
84+
"isEncrypted": false,
85+
"value": "[concat('\"', subscription().subscriptionId, '\"')]"
86+
}
87+
},
88+
{
89+
"type": "Microsoft.Automation/automationAccounts/variables",
90+
"apiVersion": "2024-10-23",
91+
"name": "[concat(variables('automationAccountName'), '/SentinelTrainingResourceGroupName')]",
92+
"dependsOn": [
93+
"[resourceId('Microsoft.Automation/automationAccounts', variables('automationAccountName'))]"
94+
],
95+
"properties": {
96+
"isEncrypted": false,
97+
"value": "[concat('\"', resourceGroup().name, '\"')]"
98+
}
99+
},
100+
{
101+
"type": "Microsoft.Automation/automationAccounts/variables",
102+
"apiVersion": "2024-10-23",
103+
"name": "[concat(variables('automationAccountName'), '/SentinelTrainingLocation')]",
104+
"dependsOn": [
105+
"[resourceId('Microsoft.Automation/automationAccounts', variables('automationAccountName'))]"
106+
],
107+
"properties": {
108+
"isEncrypted": false,
109+
"value": "[concat('\"', parameters('location'), '\"')]"
110+
}
111+
},
112+
{
113+
"type": "Microsoft.Automation/automationAccounts/variables",
114+
"apiVersion": "2024-10-23",
115+
"name": "[concat(variables('automationAccountName'), '/SentinelTrainingWorkspaceName')]",
116+
"dependsOn": [
117+
"[resourceId('Microsoft.Automation/automationAccounts', variables('automationAccountName'))]"
118+
],
119+
"properties": {
120+
"isEncrypted": false,
121+
"value": "[concat('\"', parameters('WorkspaceName'), '\"')]"
122+
}
123+
},
124+
{
125+
"type": "Microsoft.Automation/automationAccounts/jobSchedules",
126+
"apiVersion": "2024-10-23",
127+
"name": "[concat(variables('automationAccountName'), '/', guid(variables('automationAccountName'), variables('runbookName'), variables('scheduleName'), deployment().name))]",
128+
"dependsOn": [
129+
"[resourceId('Microsoft.Automation/automationAccounts/runbooks', variables('automationAccountName'), variables('runbookName'))]",
130+
"[resourceId('Microsoft.Automation/automationAccounts/schedules', variables('automationAccountName'), variables('scheduleName'))]",
131+
"[resourceId('Microsoft.Automation/automationAccounts/variables', variables('automationAccountName'), 'SentinelTrainingSubscriptionId')]",
132+
"[resourceId('Microsoft.Automation/automationAccounts/variables', variables('automationAccountName'), 'SentinelTrainingResourceGroupName')]",
133+
"[resourceId('Microsoft.Automation/automationAccounts/variables', variables('automationAccountName'), 'SentinelTrainingLocation')]",
134+
"[resourceId('Microsoft.Automation/automationAccounts/variables', variables('automationAccountName'), 'SentinelTrainingWorkspaceName')]"
135+
],
136+
"properties": {
137+
"runbook": {
138+
"name": "[variables('runbookName')]"
139+
},
140+
"schedule": {
141+
"name": "[variables('scheduleName')]"
142+
},
143+
"parameters": {
144+
"SubscriptionId": "[subscription().subscriptionId]",
145+
"ResourceGroupName": "[resourceGroup().name]",
146+
"Location": "[parameters('location')]",
147+
"WorkspaceName": "[parameters('WorkspaceName')]"
148+
}
149+
}
150+
}
151+
],
152+
"outputs": {}
153+
}

0 commit comments

Comments
 (0)