Incident Investigation + Workbook

# Liệt kê incidents trong Sentinel
az sentinel incident list \
  --resource-group rg-az500-sentinel \
  --workspace-name law-az500-secops \
  --query "[].{title:title, severity:severity, status:status, incidentNumber:incidentNumber}" \
  -o table 2>/dev/null || echo "Dùng Portal để xem incidents — az sentinel incident list yêu cầu extension mới nhất"

# Lấy incident ID đầu tiên
INCIDENT_ID=$(az sentinel incident list \
  --resource-group rg-az500-sentinel \
  --workspace-name law-az500-secops \
  --query "[0].name" -o tsv 2>/dev/null)

echo "Incident ID: $INCIDENT_ID"

# Cập nhật status incident sang Active
az sentinel incident update \
  --resource-group rg-az500-sentinel \
  --workspace-name law-az500-secops \
  --incident-id "$INCIDENT_ID" \
  --status Active \
  --owner-object-id "$(az ad signed-in-user show --query id -o tsv)" \
  2>/dev/null || echo "Cập nhật incident qua Portal: Status → Active, Assign to me"

# Thêm comment điều tra vào incident
az sentinel incident comment create \
  --resource-group rg-az500-sentinel \
  --workspace-name law-az500-secops \
  --incident-id "$INCIDENT_ID" \
  --message "Investigating — delete operation by admin lab account. Checking if this was intentional lab cleanup or unauthorized action." \
  2>/dev/null || echo "Thêm comment qua Portal: Incident → Comments → Add comment"

# Xem danh sách comments
az sentinel incident comment list \
  --resource-group rg-az500-sentinel \
  --workspace-name law-az500-secops \
  --incident-id "$INCIDENT_ID" \
  --query "[].{author:author.name, message:message, time:createdTimeUtc}" \
  -o table 2>/dev/null

WORKSPACE_ID=$(az monitor log-analytics workspace show \
  --resource-group rg-az500-sentinel \
  --workspace-name law-az500-secops \
  --query id -o tsv)

# Chạy hunting query: tóm tắt theo user
az monitor log-analytics query \
  --workspace "$WORKSPACE_ID" \
  --analytics-query "AzureActivity | where TimeGenerated > ago(7d) | summarize TotalEvents=count() by Caller, OperationNameValue | order by TotalEvents desc | limit 20" \
  -o table 2>/dev/null || echo "Chạy query trong Sentinel → Logs hoặc Hunting"

# Thêm comment cuối trước khi đóng
az sentinel incident comment create \
  --resource-group rg-az500-sentinel \
  --workspace-name law-az500-secops \
  --incident-id "$INCIDENT_ID" \
  --message "Investigation complete. Delete operations confirmed as intentional lab cleanup by admin account. No attack indicators found. Rule should be tuned to exclude lab admin accounts." \
  2>/dev/null

# Đóng incident với classification Benign Positive
az sentinel incident update \
  --resource-group rg-az500-sentinel \
  --workspace-name law-az500-secops \
  --incident-id "$INCIDENT_ID" \
  --status Closed \
  --classification BenignPositive \
  --classification-reason InaccurateData \
  2>/dev/null || echo "Đóng incident qua Portal: Actions → Close incident → Classification → Close"

# Xác nhận incident đã closed
az sentinel incident show \
  --resource-group rg-az500-sentinel \
  --workspace-name law-az500-secops \
  --incident-id "$INCIDENT_ID" \
  --query "{title:title, status:status, classification:classification}" \
  -o table 2>/dev/null