Security Labs
Hands-on cloud security labs and guides, with reviewed source and clearly scoped evidence.
Agent 365 Defender Playbook
Validate current Defender for AI Services model alerts and Sentinel correlations for a tool-using Azure AI application.
- Source reviewed
GigaWiper Detection as Code
Validate five behavior-based Defender XDR custom-detection designs with live and synthetic evidence, document an observed Sentinel Repositories preview result, and use a bounded Graph-only OIDC fallback without destructive activity.
- Source reviewed
- Live evidence available
Historical July 11–14 tenant validation and retirement; later source changes were checked offline, not redeployed.
AKS Runtime Security with Defender for Cloud
Deploy binary drift detection, container anti-malware, and gated deployment on AKS with Microsoft Defender for Cloud. Includes Bicep templates, KQL detections, and a Sentinel workbook.
- Source reviewed
Defender for Storage Malware Scanning and Sentinel
Deploy malware scanning for uploaded blobs and correlate post-verdict reads in Sentinel with Bicep, analytics rules, a workbook, and safe simulations.
- Source reviewed
LLM Prompt Injection Firewall
Deploy a serverless prompt injection firewall with AWS Lambda, API Gateway, and DynamoDB. Complete Terraform code included.
- Source reviewed
OAuth Redirect Abuse Detection with Microsoft Sentinel
Deploy Sentinel analytics rules and a security workbook, run a read-only OAuth audit, and optionally apply Entra ID hardening; five KQL hunting queries are included for manual use.
- Source reviewed
Entra Device Code Phishing Detection
Hunt device-code phishing across Sentinel and Defender XDR with safe replay data, telemetry checks, KQL detections, and a triage checklist.
- Source reviewed
Custom Sentinel Connector with CCF Push
Build a reviewed CCF Push artifact set and owned Sentinel sandbox for Feodotracker ingestion, rule examples, hunting, and visualization.
- Source reviewed
Detecting Infostealer Session Hijacking in Microsoft Sentinel
Deploy 5 Sentinel analytics rules and a Session Hijack Threat Dashboard, with 5 included hunting queries for stolen-token and session-hijack investigations.
- Source reviewed
Just-In-Time Access for AI Agents in Azure
Deploy a ZSP gateway that grants temporary Azure permissions to AI agents, automation workflows, and service principals. Bicep + PowerShell included.
- Source reviewed
Container SBOM, Signing, and Attestation
Build a keyless container supply-chain pipeline with vulnerability scanning, SBOM generation, signing, provenance, and deployment verification.
- Source reviewed
- Live evidence available
GitHub/GHCR publication and signature, SPDX SBOM and provenance verification at 2026-09-26 03:31:15 UTC (September 25 in America/Chicago) for the pinned revision; no tenant or admission deployment.
Sentinel Data Federation and Custom Graphs
Guide for federating synthetic security context into Sentinel and modeling hidden privilege paths with reusable KQL, GQL, and sample tables.
- Source reviewed
Keep Supported Secrets Out of Terraform State
Compare traditional secret arguments with Terraform write-only and ephemeral patterns across AWS and Azure, then scan state for accidental exposure.
- Source reviewed
Defender KSPM Controller Scope
Reproduce the evidence checks behind a live AKS experiment: stable registry finding identity across a template rollout, and root-filesystem finding removal without an explicit Healthy record.
- Source reviewed
- Live evidence available
Run 2: agentless baseline with Deployment attribution, verified template rollout, and registry finding identity preserved with a new supporting pod. Root-filesystem finding absent; no explicit Healthy/resolved record. Run 1 is Kubernetes-only.
No projects match these filters. Try another topic or platform, or clear the filters.