{"repo":"iknowjason/PurpleCloud","free":true,"listed":false,"github":"https://github.com/iknowjason/PurpleCloud","clone":"git clone https://github.com/iknowjason/PurpleCloud.git","description":"A little tool to play with Azure Identity - Azure and Entra ID lab creation tool. Blog: https://medium.com/@iknowjason/sentinel-for-purple-teaming-183b7df7a2f4","language":"Python","stars":653,"topics":["azure","pentest","purpleteam","siem","dfir","dfir-automation","azure-lab"],"license":"MIT","category":"deployment-docker-iac","readme_excerpt":"Documentation Terraform code generator to create different Azure security labs. For full documentation visit: https://www.purplecloud.network Changelog 10/18/24: Updated Azure Sentinel Generator (Updated AADDiagnostic Setting log categories) - On sentinel.py: Added more categories for logging and sending to the LAW, including: NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs, ManagedIdentitySignInLogs. See the following blog describing this Sentinel code update: https://medium.com/@iknowjason/sentinel-for-purple-teaming-183b7df7a2f4 10/16/24: Updated Azure Sentinel Generator (Updated Managed Identity Roles) - On sentinel.py: Added more Managed Identity VM attack pathways on each Windows 10 system. Added for roles of Owner, Virtual Machine Contributor, Key Vault Reader on user-assigned. On SystemAssigned, added roles of Contributor, Virtual Machine Contributor, Key Vault Reader. 8/20/24: Updated Azure Sentinel Generator (Detection Engineering Update: Get endpoint and Entra logs in same LAW) - On sentinel.py: Updated new Azure Monitor Agent (AMA) automated installation on dc and all windows endpoints! From now on, all windows endpoints automatically send logs to Log Analytics Workspace / Sentinel. Updated detection rule filter for Sysmon and Windows / Security event logs. - On sentinel.py: Added Managed Identity VM attack pathway. - On sentinel.py: Added Diagnostic setting automated terraform deployment to send Entra ID logs to Log Analytics Workspace / Sentinel - On se","default_branch":null,"files":null,"tree":[],"storefront":"/r/iknowjason","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/iknowjason/PurpleCloud/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}