Error in user YAML: (<unknown>): mapping values are not allowed in this context at line 2 column 19

---
lab:
    title: TechLab: Defender for APIs
    description:
    level: 300
    duration: 90 minutes
    islab: true
    primarytopics:
---

@lab.Title

---

⌛ Estimated time to complete this lab: 60 minutes

===

Using this Lab

[!hint] Copy Text Supported

The fill in fields of this simulation require the exact text be entered to progress. To make that easyer, you can select ++Copy Text++ options in the instructions pane to copy directly into your simulation text entry fields.

---

###Images and diagrams

All images and diagrams in the lab instructions are selectable. Selecting any image opens a zoomed view in a separate window for better clarity and analysis.

---

###Split Window feature

If you're equipped with multiple screens, you can use the Split Window feature to place the lab instructions on a separate screen, making better use of your screen real estate.

To enable this feature:

1. Go to the gear icon in the upper-right corner of the instructions pane.

2. At the bottom of the Settings pane, select Split Windows.

===

Task 01: Enable Microsoft Defender services

1. [] From the Azure portal, select Microsoft Defender for Cloud from the dashboard.

   

2. [] In the left side pane, go to Management, then select Environment settings.

3. [] On the lower side of the page, select Expand all.

   

4. [] Select the TechMaster-lod52521853 subscription.

5. [] Under the Cloud Workload Protection (CWPP) section, turn on the following services:

   • [] App Service
   • [] Key Vault
   • [] Resource Manager

   

6. [] On the upper side of the page, select Save.

   

===

[!alert] In a real environment, you would need to wait 24 hours before proceeding.

Task 02: Trigger a Resource Manager MicroBurst alert

1. [] On the system task bar, select the Windows PowerShell ISE icon.

   

2. [] In PowerShell, select the New file icon.

   

3. [] In the top pane, in the Untitled.ps1 file, right-click and select Paste:

   [!hint] The code below is already copied in the clipboard, you DO NOT need to copy it again.

   # Script to alert ARM_MicroBurst.AzDomainInfo alert
   
   # Login to the Azure account and get a random Resource group
   $accountContext = Connect-AzAccount
   $subscriptionId = $accountContext.Context.Subscription.Name
   $resourceGroup = Get-AzResourceGroup | Get-Random
   $rg = $resourceGroup.ResourceGroupName
   Write-Output "[*] Dumping information`nSubscription: $subscriptionId`nResource group: $rg."
   
   Write-Output "[*] Scanning Storage Accounts..."
   $storageAccountLists = Get-AzStorageAccount -ResourceGroupName $rg | select StorageAccountName,ResourceGroupName
   
   Write-Output "[*] Scanning Azure Resource Groups..."
   $resourceGroups = Get-AzResourceGroup
   
   Write-Output "[*] Scanning Azure Resources..."
   $resourceLists = Get-AzResource
   
   Write-Output "[*] Scanning AzureSQL Resources..."
   $azureSQLServers = Get-AzResource | where {$_.ResourceType -Like "Microsoft.Sql/servers"}
   
   Write-Output "[*] Scanning Azure App Services..."
   $appServs = Get-AzWebApp -ResourceGroupName $rg
   
   Write-Output "[*] Scanning Azure App Services #2..."
   $appServs = Get-AzWebApp -ResourceGroupName $rg
   
   Write-Output "[*] Scanning Azure Disks..."
   $disks = (Get-AzDisk | select ResourceGroupName, ManagedBy, Zones, TimeCreated, OsType, HyperVGeneration, DiskSizeGB, DiskSizeBytes, UniqueId, EncryptionSettingsCollection, ProvisioningState, DiskIOPSReadWrite, DiskMBpsReadWrite, DiskIOPSReadOnly, DiskMBpsReadOnly, DiskState, MaxShares, Id, Name, Location -ExpandProperty Encryption)
   
   Write-Output "[*] Scanning Azure Deployments and Parameters..."
   $idk = Get-AzResourceGroupDeployment -ResourceGroupName $rg
   
   Write-Output "[*] Scanning Virtual Machines..."
   $VMList = Get-AzVM
   
   Write-Output "[*] Scanning Virtual Machine Scale Sets..."
   $scaleSets = Get-AzVmss
   
   Write-Output "[*] Scanning Network Interfaces..."
   $NICList = Get-AzNetworkInterface
   
   Write-Output "[*] Scanning Public IPs for each Network Interface..."
   $pubIPs = Get-AzPublicIpAddress | select Name,IpAddress,PublicIpAllocationMethod,ResourceGroupName
   
   Write-Output "[*] Scanning Network Security Groups..."
   $NSGList = Get-AzNetworkSecurityGroup | select Name, ResourceGroupName, Location, SecurityRules, DefaultSecurityRules
       
   Write-Output "[*] Scanning RBAC Users and Roles..."    
   $roleAssignment = Get-AzRoleAssignment
   
   Write-Output "[*] Scanning Roles Definitions..." 
   $roles = Get-AzRoleDefinition 
   
   Write-Output "[*] Scanning Automation Account Runbooks and Variables..."
   $autoAccounts = Get-AzAutomationAccount
   
   Write-Output "[*] Scanning Tenant Information..."
   $tenantID = Get-AzTenant | select TenantId
   
   Write-Output "[!] Done Running."
   

4. [] On the top bar, select the Run Script () icon.

   

   [!note] This will open a new browser tab.

5. [] Select the Edge browser in the system tray to confirm you are authenticated.

6. [] Once authenticated, return to PowerShell.

7. [] This will scan your resource group for various resources, which Resource Manager will pick up as suspicious.

   

   [!alert] In a real environmnet it may take up to 60 minutes between script completion and the alert appearing in Defender.

===

Task 03: Grant Key Vault Secrets User role

1. [] Go back to your Azure tab in the Edge browser.

2. [] In Azure's search bar, type ++Resource groups++, press Enter then select it from the results.

   

3. [] Select ResourceGroup1.

4. [] Select the kv-ta-lab-61416944 key vault resource.

5. [] In the left side pane, select Access control (IAM).

6. [] On the upper action menu, select + Add, then Add role assignment.

   

7. [] In the list search box, type ++Key Vault Secrets User++ and press Enter.

8. [] Select the third line item, Key Vault Secrets User.

   

9. [] On the lower side of the page, select Next.

10. [] Choose + Select members.

    

11. [] In the flyout pane:

    1. [] Search for ++User1-61416944@LODSPRODMCA.onmicrosoft.com++ and pres Enter.

    2. [] Select user User1-61416944@LODSPRODMCA.onmicrosoft.com from the results.

    3. [] At the bottom of the pane, choose Select.

       

12. [] On the lower side of the page, select Review + assign twice to confirm and add your new assignment.

===

Task 04: Trigger a key vault alert

1. [] On the system task bar, open Tor Browser.

   

2. [] From the Azure dashboard, select Resource groups.

   

3. [] Select the kv-ta-lab-61416944 key vault resource.

4. [] In the left side pane, go to Objects, then Secrets.

5. [] Select LabSecret.

6. [] Select the random ID under the Version column.

   

7. [] Select Show Secret Value.

   

   [!knowledge] After some time, Defender for Key Vault will trigger an alert with detailed information about this suspicious activity.

===

Task 05: Trigger an app service alert

Microsoft Defender for App Service provides dedicated security analytics that help you identify a variety of threats to your App Service resources, based on monitoring of various relevant parts. Additionally, enabling Microsoft Defender for App Service assesses your App Service resources and provides security recommendations with detailed best practice guidance on how to harden those resources.

1. [] Go back to your Azure tab in Edge.

2. [] Near the upper-left corner of the page, select the ResourceGroup1 breadcrumb link.

   

3. [] Select the app-ta-lab-61416944 app service.

   

4. [] Under the Essentials section, note the value of Default domain.

   

5. [] In the browser bar, go to the next tab: app-ta-lab-61416944.

   

   [!alert] The link opened here will trigger a sample alert after 2 to 4 hours (app-ta-lab-@lab.LabInstance.Id.azurewebsites.net/This_Will_Generate_ASC_Alert). The message in the image is expected.

===

Task 06: Verification and review

1. [] In the browser bar, go back to the first tab.

   

2. [] In the Azure search bar, type ++Microsoft Defender for Cloud++, press Enter then select the result.

   

3. [] In the left side pane, under General, select Security alerts.

4. [] In the alert list, select the MicroBurst exploitation toolkit... alert.

5. [] Observe the details in the flyout pane and select View full details.

   

6. [] Select Microsoft Defender for Cloud | Security alerts from the breadcrumbs menu, to go back to the security alerts list.

   

7. [] From the alert list, select the Access from a TOR exit node... alert and observe the results.

   

8. [] Select Microsoft Defender for Cloud | Security alerts from the breadcrumbs menu, to go back to the security alerts list.

9. [] From the alert list, select EICAR alert.

10. [] On the lower side of the flyout pane, select View full details.

    

11. [] Observe the detection of the sample alert trigger when you visited the URL for your web app.

    

===

[!Alert] IMPORTANT: These labs are hosted on the Skillable platform. Completion data is collected and then exported to Success Factors every Monday. SF require another 1-3 days to process that data. The status for this lab will be visible in Viva and Learning Path next week.

Be sure to select "Submit" in the bottom right corner to get credit for completing this lab.

@lab.ActivityGroup(completionsurvey)

[!Alert] After answering the survey questions, select submit to complete and end the lab. This is required in order to receive credit for lab completion.