Defender for Servers + Vulnerability Assessment

# Lấy subscription ID hiện tại
SUBSCRIPTION_ID=$(az account show --query id -o tsv)

# Bật Defender for Servers Plan 2
az security pricing create \
  --name VirtualMachines \
  --tier Standard \
  --subplan P2

# Xác nhận plan đang active
az security pricing show \
  --name VirtualMachines \
  --query "{name:name, pricingTier:pricingTier, subPlan:subPlan}"

# Tạo resource group
az group create \
  --name rg-az500-defender \
  --location southeastasia \
  --tags "owner=hoatranlab" "env=lab" "module=az500-lab47"

# Tạo VM Windows Server 2022 (size nhỏ để tiết kiệm)
az vm create \
  --resource-group rg-az500-defender \
  --name vm-az500-lab47 \
  --image Win2022AzureEditionCore \
  --size Standard_B2s \
  --admin-username azureadmin \
  --admin-password "P@ssw0rd2026!Lab47" \
  --location southeastasia \
  --no-wait

# Kiểm tra VM đã được tạo
az vm show \
  --resource-group rg-az500-defender \
  --name vm-az500-lab47 \
  --query "{name:name, powerState:powerState, location:location}" \
  -o table

# Xem danh sách resource trong Defender inventory (cần thời gian để populate)
az security resource list \
  --query "[?type=='microsoft.compute/virtualmachines'].{name:name, type:type}" \
  -o table 2>/dev/null || echo "Dùng Portal để xem Inventory sau 15-30 phút"

# Kiểm tra Defender for Servers plan và subplan
az security pricing show \
  --name VirtualMachines \
  --query "{plan:pricingTier, subPlan:subPlan, extensions:extensions}"

# Xem tất cả Defender plans đang active
az security pricing list \
  --query "[?pricingTier=='Standard'].{name:name, tier:pricingTier, subPlan:subPlan}" \
  -o table

# Xem recommendations liên quan đến VM
az security task list \
  --query "[?contains(securityTaskParameters.name,'vulnerability')].{name:securityTaskParameters.name, state:state}" \
  -o table 2>/dev/null || echo "Dùng Portal: Defender for Cloud → Recommendations để xem findings"

# Xem sub-assessments (vulnerability findings) trên VM
SUBSCRIPTION_ID=$(az account show --query id -o tsv)
VM_ID="/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/rg-az500-defender/providers/Microsoft.Compute/virtualMachines/vm-az500-lab47"

# List vulnerability assessments cho VM
az security sub-assessment list \
  --assessed-resource-id "$VM_ID" \
  --assessment-name "1195afff-c881-495e-9bc5-1486211ae03f" \
  --query "[].{id:id, displayName:displayName, severity:status.severity, state:status.code}" \
  -o table 2>/dev/null || echo "Findings sẽ xuất hiện sau 30+ phút scan đầu tiên"

# Xem tất cả security assessments trên resource group
az security assessment list \
  --resource-group rg-az500-defender \
  --query "[?status.code=='Unhealthy'].{name:displayName, severity:metadata.severity}" \
  -o table

# Xem security alerts trong 7 ngày
az security alert list \
  --query "[?timeGeneratedUtc >= '2026-01-01'].{name:alertDisplayName, severity:severity, state:status}" \
  -o table

# Xem top recommendations theo severity
az security assessment list \
  --query "sort_by([?status.code=='Unhealthy'], &metadata.severity)[].{severity:metadata.severity, name:displayName}" \
  -o table | head -20

# Xem Secure Score hiện tại
az security secure-score-controls list \
  --secure-score-name "ascScore" \
  --query "[].{control:displayName, score:score.current, maxScore:score.max}" \
  -o table 2>/dev/null