microsoft/TechLabModule17-DefenderCSPM

microsoft/TechLabModule17-DefenderCSPM

License: MIT

Stars: 0

Forks: 1

Open issues: 2

Created: 2026-06-23T21:15:26Z

Pushed: 2026-07-10T10:51:50Z

Default branch: main

Fork: no

Archived: no

README: --- lab: title: TechLab: Module 17 - Defender CSPM description: level: 200 duration: 60 minutes islab: true primarytopics: ---

@lab.Title

Please enter your own Microsoft alias (without the @microsoft.com) in the field below before starting the lab. This information is required to correctly associate your activity with your learner record and ensure your completion is accurately captured and reported. For data integrity and compliance reasons, learners may only enter their own alias. After completing the lab, please allow up to 5 business days for all reporting systems to fully reflect your completion.

@lab.ActivityGroup(aliascapture)

===

Survey

@lab.ActivityGroup(initialsurvey)

===

Objectives

In this lab, you'll learn how to enable Defender for CSPM and leverage Defender for CSPM Capabilities

Scenario

Adatum Corporation had a robust cybersecurity infrastructure in place. However, one day, an attacker used a brute force or password spraying attack to gain access to an Internet-exposed server of the organization.

The attacker could quickly move laterally through the network, exploiting vulnerabilities on the Internet-exposed servers and gaining access to the organization's Storage Accounts, SQL servers, and Key Vaults. The SOC department was alerted by Defender for Cloud on the "Brute Force, Password Spray" IOC/IOA, and quickly realized something was wrong when they noticed unusual activity on the servers and Storage Accounts.

In response to the attack, the security engineers leveraged the attack path analysis to identify the entry point of the attack and the path the attackers used to move laterally through the network. Based on this analysis, they were able to close the entry point and cut off the attackers' access to the organization's data.

Additionally, they utilized Sensitive Data Discovery to identify and secure sensitive information that could be at risk of exposure. Permission Management tools were implemented to review and tighten access controls, ensuring that permissions were strictly granted based on the principle of least privilege. The discovery of plaintext secrets in the environment prompted the integration of Secret Discovery tools to encrypt sensitive data and manage secrets more securely.

The IT department didn't stop there. They also took a proactive approach by implementing security recommendations to fix the vulnerabilities on the Internet-exposed servers and prevent similar attacks in the future. Utilizing the Risk Prioritization feature of DCSPM, the security team gained full visibility into which recommendations should be prioritized, focusing their efforts on addressing the most critical vulnerabilities first. Additionally, they implemented a robust incident response plan and conducted regular security training for employees.

Thanks to the combination of both reactive and proactive measures, Adatum Corporation was able to prevent a major data breach and keep their sensitive information safe. This hypothetical use case demonstrates the importance of having both a reactive and proactive approach when it comes to cybersecurity, including performing attack path and security risk analysis, implementing security recommendations, assigning/managing change actions to the proper owners, and educating employees to prevent future attacks.

In this exercise, we will explore the Attack Path feature of Defender CSPM. Through a hands-on scenario, you will learn how to identify and mitigate potential security breaches that exploit critical vulnerabilities and inadequate permission settings in cloud environments.

---

⌛ Estimated time to complete this lab: 60 minutes

===

Using this Lab

>[!hint] Copy Text Supported > > The fill in fields of this simulation require the exact text be entered to progress. To make that easier, you can select ++Copy Text++ options in the instructions pane to copy directly into your simulation text entry fields.

---

###Images and diagrams

All images and diagrams in the lab instructions are selectable. Selecting any image opens a zoomed view in a separate window for better clarity and analysis.

---

###Split Window feature

If you're equipped with multiple screens, you can use the Split Window feature to place the lab instructions on a separate screen, making better use of your screen real estate.

To enable this feature:

1. Go to the gear icon in the upper-right corner of the instructions pane.

1. At the bottom of the Settings pane, select Split Windows.


===

Task 01: Enable Defender CSPM

1. From the Azure dashboard, select Microsoft Defender for Cloud.


1. On the left side pane, select Management, then Environment settings.

1. On the lower side of the page, select Expand all.


1. Select the TechMaster-lod52521856 subscription.

1. Turn on Defender CSPM.


1. In the upper-left corner of the page, select Save.

>[!alert] The agentless scanning engines will begin their assessments and are expected to generate insights within 24 hours. In a real environment you would need to allow this time for the initial data collection and analysis to complete, then return to review the results.

===

Task 02: Build queries with Cloud Security Explorer

You'll utilize Cloud Security Explorer in Microsoft Defender for Cloud to perform an ad-hoc risk analysis by querying and identifying risky resources within your cloud environment. You'll learn how to use predefined query templates and the query builder to enhance your understanding of how to effectively search for vulnerabilities in your environment.

---

1. In the upper-left corner of the page, select the Microsoft Defender for Cloud | Environment settings breadcrumb link.


1. On the left side pane, select General, then Cloud Security Explorer.

1. Choose the Select resource types dropdown menu.


1. Select Compute, expand Virtual machines, select **Azure Virtual...