Sentinel + Azure Activity + Analytics Rule

# Tạo resource group
az group create \
  --name rg-az500-sentinel \
  --location southeastasia \
  --tags "owner=hoatranlab" "env=lab" "module=az500-lab49"

# Tạo Log Analytics Workspace
az monitor log-analytics workspace create \
  --resource-group rg-az500-sentinel \
  --workspace-name law-az500-secops \
  --location southeastasia \
  --sku PerGB2018 \
  --retention-time 30

# Lấy workspace ID
WORKSPACE_ID=$(az monitor log-analytics workspace show \
  --resource-group rg-az500-sentinel \
  --workspace-name law-az500-secops \
  --query id -o tsv)

echo "Workspace ID: $WORKSPACE_ID"

# Enable Microsoft Sentinel (cần extension)
az extension add --name sentinel 2>/dev/null
az sentinel workspace create \
  --resource-group rg-az500-sentinel \
  --workspace-name law-az500-secops \
  --location southeastasia 2>/dev/null || echo "Dùng Portal để enable Sentinel: chọn workspace law-az500-secops"

# Lấy subscription ID và workspace ID
SUBSCRIPTION_ID=$(az account show --query id -o tsv)
WORKSPACE_ID=$(az monitor log-analytics workspace show \
  --resource-group rg-az500-sentinel \
  --workspace-name law-az500-secops \
  --query id -o tsv)

# Tạo Diagnostic Settings để gửi Activity Log vào LAW
az monitor diagnostic-settings create \
  --name "sentinel-activity-connector" \
  --resource "/subscriptions/${SUBSCRIPTION_ID}" \
  --workspace "$WORKSPACE_ID" \
  --logs '[
    {
      "category": "Administrative",
      "enabled": true
    },
    {
      "category": "Security",
      "enabled": true
    },
    {
      "category": "ServiceHealth",
      "enabled": true
    },
    {
      "category": "Alert",
      "enabled": true
    },
    {
      "category": "Policy",
      "enabled": true
    }
  ]'

echo "Azure Activity connector configured successfully"

# Xác nhận diagnostic settings đã tạo
az monitor diagnostic-settings show \
  --name "sentinel-activity-connector" \
  --resource "/subscriptions/${SUBSCRIPTION_ID}" \
  --query "{name:name, workspaceId:workspaceId}" -o table

# Tạo resource group test (sinh Create activity log)
az group create \
  --name rg-az500-test-delete \
  --location southeastasia

# Chờ 2 phút rồi xóa (sinh Delete activity log)
sleep 120
az group delete \
  --name rg-az500-test-delete \
  --yes \
  --no-wait

echo "Delete operation initiated — activity log will appear in Sentinel in ~15 minutes"

# Query KQL từ CLI (thay WORKSPACE_ID)
WORKSPACE_ID=$(az monitor log-analytics workspace show \
  --resource-group rg-az500-sentinel \
  --workspace-name law-az500-secops \
  --query id -o tsv)

# Chạy KQL query từ CLI
az monitor log-analytics query \
  --workspace "$WORKSPACE_ID" \
  --analytics-query "AzureActivity | where TimeGenerated > ago(1h) | where OperationNameValue has 'delete' | project TimeGenerated, Caller, OperationNameValue, ResourceGroup, ActivityStatusValue | order by TimeGenerated desc | limit 10" \
  -o table 2>/dev/null || echo "Chạy KQL trực tiếp trong Sentinel → Logs sau 15-30 phút"

# Tạo analytics rule qua az sentinel (nếu extension hỗ trợ)
az sentinel alert-rule create \
  --resource-group rg-az500-sentinel \
  --workspace-name law-az500-secops \
  --rule-id "detect-delete-operations" \
  --etag '"*"' \
  --kind "Scheduled" \
  --display-name "Detect Azure Resource Delete Operations" \
  --enabled true \
  --query-text "AzureActivity | where TimeGenerated > ago(24h) | where OperationNameValue has 'delete' | project TimeGenerated, Caller, OperationNameValue, ResourceGroup, ActivityStatusValue | order by TimeGenerated desc" \
  --query-frequency "PT5M" \
  --query-period "P1D" \
  --severity "Medium" \
  --trigger-operator "GreaterThan" \
  --trigger-threshold 0 \
  --incident-configuration '{"createIncident":true,"groupingConfiguration":{"enabled":false}}' \
  2>/dev/null || echo "Dùng Portal để tạo Scheduled Query Rule — az sentinel extension có thể cần cập nhật"

# Xem danh sách analytics rules đã tạo
az sentinel alert-rule list \
  --resource-group rg-az500-sentinel \
  --workspace-name law-az500-secops \
  --query "[].{name:displayName, kind:kind, enabled:enabled}" \
  -o table 2>/dev/null