### Windows Endpoint and AD Domain Controller Setup

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/ad.md

Configure the number of Windows 10 Pro systems to build and whether to create an Active Directory Domain Controller with ELK for hunting.

```bash
--endpoints <num_of_endpoints>
```

```bash
--helk
```

```bash
--domain_controller
```

--------------------------------

### Basic ADFS Lab Setup

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/adfs.md

Deploys a lab with a single ADFS server and Domain Controller using a self-signed certificate. Creates five AD users in the 'rtc.local' domain.

```python
python3 adfs.py
```

--------------------------------

### ADFS Bootstrap Script Explanation

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/adfs.md

This describes the functionality of the main ADFS bootstrap script and its dependencies. It outlines how ADFS components are installed and how domain join is handled.

```powershell
bootstrap-adfs.ps1.tpl
```

```powershell
domain_join.ps1.tpl
```

```powershell
install_adfs.ps1.tpl
```

--------------------------------

### ADFS, DC, and Windows 10 with CSV User Import

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/adfs.md

Similar to the previous example, but imports custom AD users from a specified CSV file. Ensures users are in the correct format for import.

```python
python3 adfs.py --ad_domain rtcfingroup.com --admin RTCAdmin --password MyPassword012345 --csv users.csv --endpoints 1 --domain_join --ad_users 500
```

--------------------------------

### RDP Connection Cheat Sheet for Azure AD Login

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/aadjoin.md

Provides example commands to connect to Ubuntu Linux VMs via RDP using Azure AD credentials. Ensure Azure NSGs are whitelisted to your IP address.

```bash
xfreerdp --no-nla -u "AzureAD\chasemiller@rtcfingroup.com" -p "cosmic-stingray-96W-r" --ignore-certificate 20.124.129.181
xfreerdp --no-nla -u "AzureAD\arielparsons@rtcfingroup.com" -p "cosmic-stingray-96W-r" --ignore-certificate 20.124.129.181
xfreerdp --no-nla -u "AzureAD\michaelbarnett@rtcfingroup.com" -p "cosmic-stingray-96W-r" --ignore-certificate 20.124.129.181
xfreerdp --no-nla -u "AzureAD\brandongonzalez@rtcfingroup.com" -p "cosmic-stingray-96W-r" --ignore-certificate 20.124.129.181
xfreerdp --no-nla -u "AzureAD\jessicafields@rtcfingroup.com" -p "cosmic-stingray-96W-r" --ignore-certificate 20.124.129.181
xfreerdp --no-nla -u "AzureAD\brittanyriddle@rtcfingroup.com" -p "cosmic-stingray-96W-r" --ignore-certificate 20.124.129.181
xfreerdp --no-nla -u "AzureAD\rebeccaperry@rtcfingroup.com" -p "cosmic-stingray-96W-r" --ignore-certificate 20.124.129.181
xfreerdp --no-nla -u "AzureAD\josephedwards@rtcfingroup.com" -p "cosmic-stingray-96W-r" --ignore-certificate 20.124.129.181
xfreerdp --no-nla -u "AzureAD\christopherandersen@rtcfingroup.com" -p "cosmic-stingray-96W-r" --ignore-certificate 20.124.129.181
xfreerdp --no-nla -u "AzureAD\kevinmiller@rtcfingroup.com" -p "cosmic-stingray-96W-r" --ignore-certificate 20.124.129.181
```

--------------------------------

### Build HELK and Velociraptor Server with Endpoint

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/ad.md

This command initiates the setup of a Velociraptor and HELK server, along with a Windows 10 endpoint. It configures winlogbeat for log shipping to HELK and registers the endpoint with Velociraptor.

```bash
python3 ad.py --helk --endpoint 1
```

--------------------------------

### Install Git Large File Support (LFS) on Ubuntu

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/install.md

Install the git-lfs extension on Ubuntu Linux to handle large files within the repository. This is necessary if you plan to download large files using the git client.

```bash
apt-get install git-lfs
```

--------------------------------

### ADFS Server Information Log

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/adfs.md

Example log output showing ADFS server details, including hostname, FQDN, and the signon endpoint. This information is useful for tracking and accessing the ADFS service.

```text
[+] Creating the adfs terraform file:  adfs.tf
  [+] ADFS Server Information:
  [+] Server Hostname:  adfs
  [+] FQDN:  adfs.rtc.local
  [+] Signon Endpoint:  https://adfs.rtc.local/adfs/ls/idpinitiatedsignon.aspx
  [+] Building with Self-Signed certificate

```

--------------------------------

### Clone PurpleCloud Repository

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/install.md

Clone the PurpleCloud repository from GitHub to your local machine. This is the first step in the installation process.

```bash
git clone https://github.com/iknowjason/PurpleCloud.git
```

--------------------------------

### Generate One Windows 10 Endpoint with Sysmon

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/ad.md

Creates a single Windows 10 endpoint with a default local administrator account and Sysmon installed. This generates several Terraform files for infrastructure setup.

```bash
python3 ad.py --endpoint 1
```

--------------------------------

### Default VM Instance Sizes in ad.py

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/cost.md

Modify these variables in ad.py to change the default hardware instance sizes for each VM. Note that the Hunting ELK install option #4 requires 8 GB of available memory.

```python
# The instance size for each system
size_win10 = "Standard_D2as_v4"
size_dc = "Standard_D2as_v4"
# Note:  Hunting ELK install options #4 requires 8 GB available memory
size_helk  = "Standard_D4s_v3"

```

--------------------------------

### Advanced Command Line Options for Sentinel Lab

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/sentinel.md

These command-line arguments allow for detailed configuration of the Sentinel lab environment, including resource group, location, endpoint count, domain controller setup, AD domain, user provisioning, and administrator credentials.

```bash
--resource_group <rg_name>
```

```bash
--location <location>
```

```bash
--endpoints <num_of_endpoints>
```

```bash
--domain_controller
```

```bash
--ad_domain <domain>
```

```bash
--ad_users <num_of_domain_users>
```

```bash
--csv <csv_file>
```

```bash
--admin <admin_username>
```

```bash
--password <password>
```

```bash
--domain_join
```

```bash
--auto_logon
```

--------------------------------

### Azure AD Join Lab with User Assigned Identity

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/aadjoin.md

Extends the previous example by adding a User Assigned Identity to all VMs with a specified role (e.g., Reader, Contributor, Owner) on the subscription.

```python
python3 aadjoin.py --upn rtcfingroup.com --endpoints 3 --count 30 --user_identity reader
```

--------------------------------

### Example CSV Format for Custom Domain Users

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/ad.md

Defines the required format for a CSV file used to import custom domain users into Active Directory.

```csv
name,upn,password,groups,oupath,domain_admin
Lars Borgerson,larsborgerson@rtcfingroup.com,MyPassword012345,IT,OU=IT;DC=rtcfingroup;DC=com,False
Olivia Odinsdottir,oliviaodinsdottir@rtcfingroup.com,MyPassword012345,IT,OU=IT;DC=rtcfingroup;DC=com,True
Liem Anderson,liemanderson@rtcfingroup.com,MyPassword012345,IT,OU=IT;DC=rtcfingroup;DC=com,False
John Nilsson,johnnilsson@rtcfingroup.com,MyPassword012345,IT,OU=IT;DC=rtcfingroup;DC=com,False
Jason Lindqvist,jasonlindqvist@rtcfingroup.com,MyPassword012345,IT,OU=IT;DC=rtcfingroup;DC=com,True
```

--------------------------------

### Install Python Faker Package

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/install.md

Install the Python 'faker' package using pip3. This package is a dependency for several Python scripts used to generate user data.

```bash
pip3 install faker
```

--------------------------------

### Windows 10 Pro Endpoint Configuration Dictionary

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/ad.md

This Python dictionary defines default configurations for Windows 10 Pro endpoints, including hostname base, domain join status, auto-logon, Sysmon, and Atomic Red Team installation.

```python
config_win10_endpoint = {
    "hostname_base":"win10",
    "join_domain":"false",
    "auto_logon_domain_user":"false",
    "install_sysmon":sysmon_endpoint_config,
    "install_art":"true",
}
```

--------------------------------

### Deploy Sentinel Lab with One Windows 10 Endpoint and Sysmon

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/sentinel.md

Generates a Microsoft Sentinel lab with a single Windows 10 Endpoint, including Sysmon and Atomic Red Team (ART) installed. All Windows 10 Pro systems will automatically send logs to Sentinel.

```bash
python3 sentinel.py --endpoint 1
```

--------------------------------

### Terraform Initialization and Application

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/install.md

Standard Terraform commands to initialize the project, create a plan, and apply the infrastructure changes.

```bash
terraform init
terraform plan -out=run.plan
terraform apply run.plan
```

--------------------------------

### Azure VM Pricing Details

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/cost.md

Reference links for the most up-to-date pricing information on Azure Windows and Linux virtual machines.

```text
https://azure.microsoft.com/en-us/pricing/details/virtual-machines/windows/

```

```text
https://azure.microsoft.com/en-us/pricing/details/virtual-machines/linux/

```

--------------------------------

### Generate Domain Controller with Random Users and Domain Join

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/ad.md

Sets up a Domain Controller with a specified forest name, custom administrator credentials, and 500 randomly generated domain users. Enables domain join for all created Windows 10 endpoints.

```bash
python3 ad.py --domain_controller --ad_domain rtcfingroup.com --admin RTCAdmin --password MyPassword012345 --ad_users 500 --endpoints 2  --domain_join
```

--------------------------------

### ADFS with Trusted Certificate and Custom Domain

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/adfs.md

Sets up an ADFS server and DC, importing a CA-signed certificate. Specify the certificate file, password, and AD domain name.

```python
python3 adfs.py --trusted_cert adfs.pfx --pfx_password password --ad_domain rtcsecurity.net
```

--------------------------------

### Deploy Domain Controller with Custom Users from CSV and Domain Join

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/sentinel.md

Sets up a Microsoft Sentinel deployment with a Domain Controller and imports custom domain users from a CSV file. It enables domain join for Windows 10 Pro endpoints and configures MMA for log shipping.

```bash
python3 sentinel.py --domain_controller --ad_domain rtcfingroup.com --admin RTCAdmin --password MyPassword012345 --csv users.csv --endpoints 2 --domain_join
```

--------------------------------

### Deploy Domain Controller with Random Users and Domain Join

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/sentinel.md

Creates a Microsoft Sentinel deployment with a Domain Controller, Active Directory forest, and randomly generated domain users. Enables domain join for Windows 10 Pro endpoints and configures MMA for log shipping.

```bash
python3 sentinel.py --domain_controller --ad_domain rtcfingroup.com --admin RTCAdmin --password MyPassword012345 --ad_users 500 --endpoints 2 --domain_join
```

--------------------------------

### Basic Azure AD Join Lab

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/aadjoin.md

Generates a single Windows 10 system joined to Azure AD. Creates 10 Azure AD users with the specified UPN suffix and assigns default VM administrator and user roles.

```python
python3 aadjoin.py --upn rtcfingroup.com --endpoints 1
```

--------------------------------

### Navigate to Generator Directory

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/aad.md

Before running the script, navigate to the generator's directory.

```bash
cd generators/azure_ad
```

--------------------------------

### Generate Domain Controller with Custom Users from CSV and Domain Join

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/ad.md

Configures a Domain Controller, importing custom domain users from a specified CSV file. Ensures users are in the correct format and enables domain join for Windows 10 endpoints.

```bash
python3 ad.py --domain_controller --ad_domain rtcfingroup.com --admin RTCAdmin --password MyPassword012345 --csv users.csv --endpoints 2  --domain_join
```

--------------------------------

### ADFS, DC, and Windows 10 with Random Users

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/adfs.md

Builds an Active Directory domain, joins the ADFS server to it, and creates one Windows 10 Pro endpoint. Generates 500 random AD users with specified domain, admin credentials, and endpoints.

```python
python3 adfs.py --ad_domain rtcfingroup.com --admin RTCAdmin --password MyPassword012345 --endpoints 1 --domain_join --ad_users 500
```

--------------------------------

### Active Directory Domain and User Configuration

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/ad.md

Define the AD domain name, the number of AD users to create, and specify a custom CSV file for user data.

```bash
--ad_domain <domain>
```

```bash
--ad_users <num_of_domain_users>
```

```bash
--csv <csv_file>
```

--------------------------------

### Generate Basic Azure AD Lab

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/aad.md

Generates a basic Azure AD lab with a specified UPN suffix and default user count. Outputs user details, usernames, emails, and Terraform configuration for users.

```bash
python3 azure_ad.py --upn rtcfingroup.com
```

--------------------------------

### Navigate to ad.py Directory

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/ad.md

Before running any ad.py commands, navigate to the generator's directory.

```bash
cd generators/ad
```

--------------------------------

### Generate Azure AD Lab with Applications and Groups

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/aad.md

Generates an Azure AD lab with a specified user count, number of applications, and number of groups. Includes Terraform files for applications and groups, and assigns users to groups.

```bash
python3 azure_ad.py --upn rtcfingroup.com --count 500 --apps 3 --groups 5
```

--------------------------------

### Navigate to Sentinel Generator Directory

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/sentinel.md

Before using the Sentinel lab generator, navigate to its directory using the cd command.

```bash
cd generators/sentinel
```

--------------------------------

### Azure AD Join Lab with 30 Users and 3 VMs

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/aadjoin.md

Creates 30 Azure AD users and three Windows 10 VMs for Azure AD join. A random password for all users is generated and displayed after terraform apply.

```python
python3 aadjoin.py --upn rtcfingroup.com --endpoints 3 --count 30
```

--------------------------------

### Local Administrator and Password Settings

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/ad.md

Set the local administrator username and password for the systems. A strong password is auto-generated if not provided.

```bash
--admin <admin_username>
```

```bash
--password <password>
```

--------------------------------

### Specify Number of Endpoints Parameter

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/aadjoin.md

This parameter is required to specify the number of Windows 10 VMs to build for the lab.

```bash
--endpoints <vm_count>
```

--------------------------------

### Azure Resource Group and Location Configuration

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/ad.md

Specify the Azure resource group and location for deployment. Defaults are provided if not explicitly set.

```bash
--resource_group <rg_name>
```

```bash
--location <location>
```

--------------------------------

### Navigate to ADFS Generator Directory

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/adfs.md

Before running the ADFS generator, navigate to its directory using the command line.

```bash
cd generators/adfs
```

--------------------------------

### Domain Join and Auto Logon Configuration

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/ad.md

Enable or disable joining Windows 10 Pro systems to the AD domain and automatically logging in domain users.

```bash
--domain_join
```

```bash
--auto_logon
```

--------------------------------

### Default AD User Configuration

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/adfs.md

Defines the initial set of Active Directory users. The first five users are specified here, with subsequent users being randomly generated.

```python
default_ad_users = [
    {
        "name":"Lars Borgerson",
        "ou": "CN=users,DC=rtc,DC=local",
        "password": get_password(),
        "domain_admin":"",
        "groups":"IT"
    },

```

--------------------------------

### Run Basic Sentinel Lab Deployment

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/sentinel.md

Executes the sentinel.py script to generate a Microsoft Sentinel lab with a Log Analytics workspace. This also creates terraform HCL files for sentinel.tf and providers.tf.

```bash
python3 sentinel.py
```

--------------------------------

### Enable Azure AD Data Connector

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/sentinel.md

Enables the Azure AD data connector for Microsoft Sentinel during lab deployment using the -adc flag.

```bash
python3 sentinel.py -adc
```

--------------------------------

### Enable Office 365 Data Connector

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/sentinel.md

Enables the Office 365 data connector for Microsoft Sentinel during lab deployment using the -odc flag.

```bash
python3 sentinel.py -odc
```

--------------------------------

### Navigate to aadjoin Directory

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/aadjoin.md

Before running the script, navigate to the generators/aadjoin directory.

```bash
cd generators/aadjoin
```

--------------------------------

### Run Azure Storage Lab Generator

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/storage.md

Execute the Python script to generate Terraform configuration files for Azure storage resources. Specify the resource name and location as arguments.

```bash
python3 storage.py -n <NAME> -l <LOCATION>
```

```bash
python3 storage.py -n mystoragename -l eastus
```

--------------------------------

### Navigate to Generator Directory

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/storage.md

Change the current directory to the storage generator's location before execution.

```bash
cd generators/storage
```

--------------------------------

### Terraform Configuration for Azure VM Deployment

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/aadjoin.md

Illustrates Terraform configuration for setting up Azure VMs, including network security group rules and user identity assignments. Run 'terraform apply' to update NSG rules.

```terraform
locals {
  src_ip = chomp(data.http.firewall_allowed.response_body)
  #src_ip = "0.0.0.0/0"
}
```

--------------------------------

### Query Microsoft Graph Activity Logs with KQL

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/sentinel.md

A simple KQL query to retrieve Microsoft Graph Activity logs.

```commandline
MicrosoftGraphActivityLogs
```

--------------------------------

### Generate Lab for Service Principal Abuse Attack Primitives

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/aad.md

Generates an Azure AD lab with users, applications, and service principal abuse attack primitives. Assigns roles like Application Administrator, Global Administrator, and Privileged Role Administrator to users or service principals.

```bash
python3 azure_ad.py -c 25 --upn rtcfingroup.com --apps 7 -aa -ga -pra
```

--------------------------------

### Query Windows Security Event Logs with KQL

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/sentinel.md

This KQL query fetches all Windows Security event logs from the past 24 hours. It includes parsing of event data and extraction of usernames.

```commandline
Event
| where TimeGenerated > ago(24h)
| where EventLog == "Security"
| extend EventDataXml = parse_xml(EventData).DataItem.EventData.Data
| mv-expand bagexpansion=array EventDataXml
| extend EventKey = tostring(EventDataXml['@Name']), EventValue = tostring(EventDataXml['#text'])
| extend Username = iff(EventKey == "TargetUserName" or EventKey == "SubjectUserName", EventValue, "")
| project TimeGenerated, Computer, EventID, RenderedDescription, Username, EventKey, EventValue
| summarize EventDetails=make_bag(pack(EventKey, EventValue)), Username=any(Username) by TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
```

--------------------------------

### DC Bootstrap Script Output

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/adfs.md

This is the actual rendered DC bootstrap script after variables have been applied. It can be copied to the DC for troubleshooting the Active Directory build process.

```powershell
output/dc/bootstrap-dc1.ps1
```

--------------------------------

### Default AD Users Configuration

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/ad.md

This Python list defines the initial set of default Active Directory users, including their names and organizational unit (OU) paths. Subsequent users are randomly generated.

```python
default_ad_users = [
    {
        "name":"Lars Borgerson",
        "ou": "CN=users,DC=rtc,DC=local",

```

--------------------------------

### Import Custom CSV for AD Users

Source: https://github.com/iknowjason/purplecloud/blob/master/README.md

Use the --csv flag to import your own AD users, groups, and OUs from a CSV file. The CSV file must conform to a specific format.

```bash
--csv file.csv
```

--------------------------------

### Query Sysmon Logs with KQL

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/sentinel.md

Use this KQL query to retrieve all Sysmon logs from the last 24 hours. It parses XML event data to extract specific fields and summarizes the details.

```commandline
Event
| where TimeGenerated > ago(24h)
| where Source == "Microsoft-Windows-Sysmon"
| extend EventDataXml = parse_xml(EventData).DataItem.EventData.Data
| mv-expand bagexpansion=array EventDataXml
| extend EventKey = tostring(EventDataXml['@Name']), EventValue = tostring(EventDataXml['#text'])
| extend Username = iff(EventKey == "User", EventValue, "")
| project TimeGenerated, Computer, EventID, RenderedDescription, Username, EventKey, EventValue
| summarize EventDetails=make_bag(pack(EventKey, EventValue)), Username=any(Username) by TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
```

--------------------------------

### Query Azure Sign-in Logs with KQL

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/sentinel.md

Retrieve Azure Sign-in logs from the last 7 days using this KQL query. It projects key details such as timestamp, user, application, IP address, and status.

```commandline
SigninLogs
| where TimeGenerated >= ago(7d)
| project TimeGenerated, UserPrincipalName, AppDisplayName, ResourceDisplayName, IPAddress, Status
| order by TimeGenerated desc
```

--------------------------------

### Azure Service Principal Environment Variables

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/install.md

Set these environment variables to authenticate using an Azure Service Principal. Replace 'YOUR_SERVICE_PRINCIPAL_VALUES' with your actual credentials.

```bash
export ARM_SUBSCRIPTION_ID="YOUR_SERVICE_PRINCIPAL_VALUES"
export ARM_TENANT_ID="YOUR_SERVICE_PRINCIPAL_VALUES"
export ARM_CLIENT_ID="YOUR_SERVICE_PRINCIPAL_VALUES"
export ARM_CLIENT_SECRET="YOUR_SERVICE_PRINCIPAL_VALUES"
```

--------------------------------

### Specify UPN Suffix Domain Parameter

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/aadjoin.md

This parameter is required to specify the UPN suffix domain for the Azure AD join.

```bash
--upn <upn_suffix_domain>
```

--------------------------------

### Generate Azure AD Lab with 1,000 Users

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/aad.md

Generates an Azure AD lab with a specified UPN suffix and a large user count. Terraform apply will generate a shared random password for all users, which can be retrieved with 'terraform output'.

```bash
python3 azure_ad.py --upn rtcfingroup.com --count 1000
```

--------------------------------

### ADFS Command Line Arguments

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/adfs.md

These are advanced command-line arguments used for configuring the ADFS deployment. They control aspects like the number of endpoints, resource group, location, AD domain settings, user creation, and certificate management.

```bash
--endpoints <num_of_endpoints>
```

```bash
--resource_group <rg_name>
```

```bash
--location <location>
```

```bash
--ad_domain <domain>
```

```bash
--ad_users <num_of_domain_users>
```

```bash
--csv <csv_file>
```

```bash
--admin <admin_username>
```

```bash
--password <password>
```

```bash
--domain_join
```

```bash
--auto_logon
```

```bash
--data_connector_office
```

```bash
--data_connector_aad
```

```bash
--trusted_cert <file.pfx>
```

```bash
--pfx_password <password>
```

--------------------------------

### Network Subnets Configuration

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/ad.md

The configuration for subnets can be adjusted in the python list named config_subnets. This allows for changes to default subnet names or adding/removing subnets. Four subnets are created by default.

```python
"password": get_password(),
        "domain_admin":"",
        "groups":"IT"
    },
```

--------------------------------

### Azure NSG IP Whitelisting Configuration

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/ad.md

This configuration snippet shows how to set the source IP address for Azure Network Security Groups. It demonstrates fetching the public IP address and includes a commented-out option to hardcode an IP address.

```terraform
locals {
  src_ip = chort(data.http.firewall_allowed.response_body)
  #src_ip = "0.0.0.0/0"
}
```

--------------------------------

### Specify Location for Sentinel Lab

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/sentinel.md

Allows specifying a custom location for the Microsoft Sentinel lab deployment using the -l flag. Defaults to 'eastus'.

```bash
python3 sentinel.py -l <LOCATION>
```

--------------------------------

### Add Sysmon Channel in Log Analytics Agents Configuration

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/adfs.md

Configure the Log Analytics agent to collect Sysmon operational logs. This is a required step for viewing Sysmon events in Sentinel.

```text
Microsoft-Windows-Sysmon/Operational
```

--------------------------------

### Query Azure Audit Logs with KQL

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/sentinel.md

This KQL query fetches Azure Audit logs from the past 7 days. It displays operation name, target resources, initiator, and result reason.

```commandline
AuditLogs
| where TimeGenerated >= ago(7d)
| project TimeGenerated, OperationName, TargetResources, InitiatedBy, ResultReason
| order by TimeGenerated desc
```

--------------------------------

### Query Office 365 Enriched Audit Logs with KQL

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/sentinel.md

This KQL query retrieves Enriched Microsoft 365 Audit logs.

```commandline
EnrichedMicrosoft365AuditLogs
```

--------------------------------

### Generate Lab with User Assigned Identity (Contributor Role)

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/midentity.md

Generates Terraform HCL for a managed identity lab with a user-assigned identity assigned the Contributor role on the subscription and attached to the Azure VM.

```python
python3 managed_identity.py -u rtcfingroup.com -ua contributor
```

--------------------------------

### Destroy Terraform Resources

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/install.md

Use this command to destroy all resources managed by your Terraform configuration. Ensure you have reviewed the plan before executing.

```bash
terraform destroy
```

--------------------------------

### Generate Lab with User Assigned Identity (Reader Role)

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/midentity.md

Generates Terraform HCL for a managed identity lab with a user-assigned identity assigned the Reader role on the subscription and attached to the Azure VM.

```python
python3 managed_identity.py -u rtcfingroup.com -ua reader
```

--------------------------------

### Generate Lab with User Assigned Identity (Owner Role) + System Assigned Identity

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/midentity.md

Generates Terraform HCL for a managed identity lab with a user-assigned identity assigned the Owner role, a system-assigned identity, and custom resource naming and location.

```python
python3 managed_identity.py -u rtcfingroup.com -n rtcfin -l eastus -a RTCAdmin -p MyPassword012345 -ua owner -sa
```

--------------------------------

### Azure Network Security Group Source IP Configuration

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/sentinel.md

Configures the source IP address for Azure Network Security Groups. By default, it allows access from anywhere (0.0.0.0/0). Customize this to restrict access to specific IP addresses.

```terraform
locals {
  #src_ip = chomp(data.http.firewall_allowed.response_body)
  src_ip = "0.0.0.0/0"
}

```

--------------------------------

### Azure Network Security Group Source IP Configuration

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/adfs.md

Configures the source IP address for Azure Network Security Groups. It defaults to detecting the public IP but can be overridden.

```terraform
locals {
  src_ip = chomp(data.http.firewall_allowed.response_body)
  #src_ip = "0.0.0.0/0"
}

```

--------------------------------

### Define User Role Variable for Azure AD User

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/midentity.md

Defines a Terraform variable for specifying the role to be assigned to an Azure AD user. This allows for flexible role assignment configurations.

```terraform
variable "user_role" {
  default = "Virtual Machine Contributor"
  #default = "Contributor"
  #default = "Reader"
  #default = "Owner"
}
```

--------------------------------

### Assign Reader Role to Managed Identity on Subscription

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/tools/midentity.md

Assigns the 'Reader' role to a User Assigned Identity (UAI) at the subscription scope. This is useful for granting read-only access to resources within the entire subscription.

```terraform
resource "azurerm_role_assignment" "uai" {
  #Scope to the key vault in line below
  #scope                = azurerm_key_vault.example.id
  #Scope to the subscription in line below
  scope                = data.azurerm_subscription.mi.id
  role_definition_name = "ROLE_DEFINITION_NAME"
  principal_id         = azurerm_user_assigned_identity.uai.principal_id
}
```

--------------------------------

### Assign Azure Role to Service Principal

Source: https://github.com/iknowjason/purplecloud/blob/master/docs/install.md

Assign a specific role to your Terraform Service Principal for managing Azure resources. Ensure you replace '<SP_OBJECT_ID>' with the actual object ID of your Service Principal.

```bash
az role assignment create --assignee-principal-type  ServicePrincipal --assignee-object-id <SP_OBJECT_ID> --scope "/providers/Microsoft.aadiam" --role b24988ac-6180-42a0-ab88-20f7382dd24c
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.