Terraform Script to automate forensic artifact collection in Azure
Budget: $40 – $80 USD
I am looking to create a forensic automation process in Azure. Here is what it should have:
1. Forensic Analysis VM:
Upon creation the Vm should have some basic forensic tools pre-installed.
2. Network Security Groups (NSGs) to define rules that control network traffic to and from virtual machines. Create a specific NSG with restrictive rules to isolate the VMs when needed.
3. Infection VM:
Another VM to act as an infected VM in the environment.
4. API Gateway for Incident Trigger:
In Azure, you can use Azure Functions or Azure Logic Apps to create an API endpoint that listens for POST requests to trigger incident response actions. This can be set up using Azure API Management to manage the API endpoint.
5. Incident Response Actions:
When the API receives a POST request containing the infected VM's ID, you can implement the following incident response actions in Azure:
Change the VM's Network Security Group to the isolation NSG to isolate it from the network.
Enable termination protection using Azure Policy or custom scripts to prevent accidental VM deletion.
Take an automatic snapshot of the VM's disk using Azure Backup or custom scripts.
Capture a screenshot of the VM using Azure Automation or Azure Virtual Machine Extensions.
Collect metadata and other necessary information about the VM using Azure Monitor and store it in Azure Storage or Azure Log Analytics.
6. Storage and Analysis:
Use Azure Storage, such as Azure Blob Storage, to store the collected data and forensic artifacts like screenshots and metadata.
Dont worry if you are not familiar with the forensic tools and services. I can handle that part. I want a working terraform which does these actions mentioned.
1. Forensic Analysis VM:
Upon creation the Vm should have some basic forensic tools pre-installed.
2. Network Security Groups (NSGs) to define rules that control network traffic to and from virtual machines. Create a specific NSG with restrictive rules to isolate the VMs when needed.
3. Infection VM:
Another VM to act as an infected VM in the environment.
4. API Gateway for Incident Trigger:
In Azure, you can use Azure Functions or Azure Logic Apps to create an API endpoint that listens for POST requests to trigger incident response actions. This can be set up using Azure API Management to manage the API endpoint.
5. Incident Response Actions:
When the API receives a POST request containing the infected VM's ID, you can implement the following incident response actions in Azure:
Change the VM's Network Security Group to the isolation NSG to isolate it from the network.
Enable termination protection using Azure Policy or custom scripts to prevent accidental VM deletion.
Take an automatic snapshot of the VM's disk using Azure Backup or custom scripts.
Capture a screenshot of the VM using Azure Automation or Azure Virtual Machine Extensions.
Collect metadata and other necessary information about the VM using Azure Monitor and store it in Azure Storage or Azure Log Analytics.
6. Storage and Analysis:
Use Azure Storage, such as Azure Blob Storage, to store the collected data and forensic artifacts like screenshots and metadata.
Dont worry if you are not familiar with the forensic tools and services. I can handle that part. I want a working terraform which does these actions mentioned.