Defender for Storage + Malware Scanning

# Tạo resource group
az group create \
  --name rg-az500-storage-sec \
  --location southeastasia \
  --tags "owner=hoatranlab" "env=lab" "module=az500-lab48"

# Tạo storage account (tên phải unique globally)
STORAGE_NAME="staz500lab48$(date +%s | tail -c 6)"
az storage account create \
  --name $STORAGE_NAME \
  --resource-group rg-az500-storage-sec \
  --location southeastasia \
  --sku Standard_LRS \
  --kind StorageV2 \
  --allow-blob-public-access false

# Bật Defender for Storage với malware scanning
az security defender for-storage show \
  --resource-group rg-az500-storage-sec \
  --storage-account $STORAGE_NAME 2>/dev/null || echo "Dùng Portal để bật Defender for Storage với malware scanning"

# Xem storage account vừa tạo
az storage account show \
  --name $STORAGE_NAME \
  --resource-group rg-az500-storage-sec \
  --query "{name:name, location:location, kind:kind}" -o table

echo "Storage account name: $STORAGE_NAME"

# Thay YOUR_STORAGE_NAME bằng tên storage account vừa tạo
STORAGE_NAME="YOUR_STORAGE_NAME"

# Lấy connection string
CONN_STR=$(az storage account show-connection-string \
  --name $STORAGE_NAME \
  --resource-group rg-az500-storage-sec \
  --query connectionString -o tsv)

# Tạo container "uploads"
az storage container create \
  --name uploads \
  --connection-string "$CONN_STR" \
  --public-access off

# Tạo file test bình thường
echo "This is a test file for lab 48" > test-normal.txt
az storage blob upload \
  --container-name uploads \
  --file test-normal.txt \
  --name test-normal.txt \
  --connection-string "$CONN_STR"

# Xác nhận blob được upload
az storage blob list \
  --container-name uploads \
  --connection-string "$CONN_STR" \
  --query "[].{name:name, size:properties.contentLength}" \
  -o table

# Tạo EICAR test file (chuỗi chuẩn EICAR — hoàn toàn vô hại)
printf 'X5O!P%%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > eicar-test.txt

# Kiểm tra file đã tạo đúng
cat eicar-test.txt

# Upload EICAR test file lên storage
STORAGE_NAME="YOUR_STORAGE_NAME"
CONN_STR=$(az storage account show-connection-string \
  --name $STORAGE_NAME \
  --resource-group rg-az500-storage-sec \
  --query connectionString -o tsv)

az storage blob upload \
  --container-name uploads \
  --file eicar-test.txt \
  --name eicar-test.txt \
  --connection-string "$CONN_STR"

echo "EICAR file uploaded. Check Defender for Cloud alerts in 5-10 minutes."

# Xem alerts sau khi chờ (nếu CLI hỗ trợ)
az security alert list \
  --query "[?contains(alertDisplayName,'Malware') || contains(alertDisplayName,'storage')].{name:alertDisplayName, severity:severity, time:timeGeneratedUtc}" \
  -o table

# Xem tất cả security alerts
az security alert list \
  --query "[].{name:alertDisplayName, severity:severity, state:status, time:timeGeneratedUtc}" \
  -o table

# Xem chi tiết alert (nếu có malware alert)
az security alert list \
  --query "[?severity=='High'].{name:alertDisplayName, description:description}" \
  -o json | head -50

# Kiểm tra email notification settings
az security contact list \
  --query "[].{email:email, phone:phone, alertNotifications:alertNotifications, alertsToAdmins:alertsToAdmins}" \
  -o table

# Cấu hình email notification (thay YOUR_EMAIL)
az security contact create \
  --email "[email protected]" \
  --phone "+84917516878" \
  --alert-notifications On \
  --alerts-to-admins On \
  --name "secops-contact"

echo "Email notification configured"

# Xem blob properties (bao gồm metadata) sau khi scan
STORAGE_NAME="YOUR_STORAGE_NAME"
CONN_STR=$(az storage account show-connection-string \
  --name $STORAGE_NAME \
  --resource-group rg-az500-storage-sec \
  --query connectionString -o tsv)

# Xem metadata của blob eicar test
az storage blob show \
  --container-name uploads \
  --name eicar-test.txt \
  --connection-string "$CONN_STR" \
  --query "{name:name, metadata:metadata, tags:tags}" \
  -o json

# Xem tất cả blobs với metadata
az storage blob list \
  --container-name uploads \
  --connection-string "$CONN_STR" \
  --include m \
  --query "[].{name:name, metadata:metadata}" \
  -o json

# Xem recommendations cho storage accounts
az security assessment list \
  --resource-group rg-az500-storage-sec \
  --query "[?status.code=='Unhealthy'].{name:displayName, severity:metadata.severity}" \
  -o table