Skip to content

Commit 96d56d4

Browse files
ZimmergrenZimmergren
authored
Merge branch 'main' into patch-1
2 parents a884d83 + cb47276 commit 96d56d4

File tree

20 files changed

+574
-1
lines changed

20 files changed

+574
-1
lines changed

‎.github/workflows/defender-for-devops.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
name: MSDefenderDevOps
2+
on:
3+
push:
4+
branches: [ main ]
5+
jobs:
6+
DevSec:
7+
name: Microsoft Defender for DevOps
8+
runs-on: windows-latest
9+
steps:
10+
- uses: actions/[email protected]
11+
- uses: actions/setup-dotnet@v1
12+
with:
13+
dotnet-version: 6.0.x
14+
- name: Run Microsoft Security DevOps Analysis
15+
uses: microsoft/security-devops-action@preview
16+
id: msdo
17+
- name: Upload alerts to Security tab
18+
uses: github/codeql-action/upload-sarif@v1
19+
with:
20+
sarif_file: ${{ steps.msdo.outputs.sarifFile }}

‎ApplicationInsights.RedactSensitiveInformation/ApplicationInsights.RedactSensitiveInformation/ApplicationInsights.RedactSensitiveInformation.csproj‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
<Project Sdk="Microsoft.NET.Sdk">
2+
3+
<PropertyGroup>
4+
<OutputType>Exe</OutputType>
5+
<TargetFramework>net6.0</TargetFramework>
6+
<ImplicitUsings>enable</ImplicitUsings>
7+
<Nullable>enable</Nullable>
8+
</PropertyGroup>
9+
10+
<ItemGroup>
11+
<PackageReference Include="Microsoft.ApplicationInsights" Version="2.21.0" />
12+
<PackageReference Include="Microsoft.ApplicationInsights.WorkerService" Version="2.21.0" />
13+
<PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="7.0.0" />
14+
</ItemGroup>
15+
16+
</Project>

‎ApplicationInsights.RedactSensitiveInformation/ApplicationInsights.RedactSensitiveInformation/ApplicationInsights.RedactSensitiveInformation.sln‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio Version 17
4+
VisualStudioVersion = 17.5.33530.505
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ApplicationInsights.RedactSensitiveInformation", "ApplicationInsights.RedactSensitiveInformation.csproj", "{9D050C42-82AF-435D-9B6B-F100738B19D8}"
7+
EndProject
8+
Global
9+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10+
Debug|Any CPU = Debug|Any CPU
11+
Release|Any CPU = Release|Any CPU
12+
EndGlobalSection
13+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
14+
{9D050C42-82AF-435D-9B6B-F100738B19D8}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
15+
{9D050C42-82AF-435D-9B6B-F100738B19D8}.Debug|Any CPU.Build.0 = Debug|Any CPU
16+
{9D050C42-82AF-435D-9B6B-F100738B19D8}.Release|Any CPU.ActiveCfg = Release|Any CPU
17+
{9D050C42-82AF-435D-9B6B-F100738B19D8}.Release|Any CPU.Build.0 = Release|Any CPU
18+
EndGlobalSection
19+
GlobalSection(SolutionProperties) = preSolution
20+
HideSolutionNode = FALSE
21+
EndGlobalSection
22+
GlobalSection(ExtensibilityGlobals) = postSolution
23+
SolutionGuid = {A9217409-DA3A-49F2-9C6C-B5517E73837E}
24+
EndGlobalSection
25+
EndGlobal

‎ApplicationInsights.RedactSensitiveInformation/ApplicationInsights.RedactSensitiveInformation/Program.cs‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
// Necessary using statements.
2+
using ApplicationInsights.RedactSensitiveInformation;
3+
using Microsoft.ApplicationInsights;
4+
using Microsoft.ApplicationInsights.Extensibility;
5+
using Microsoft.ApplicationInsights.WorkerService;
6+
using Microsoft.Extensions.DependencyInjection;
7+
using Microsoft.Extensions.Logging;
8+
using Microsoft.Extensions.Logging.ApplicationInsights;
9+
10+
// DEMO ONLY: Don't put credentials in code - use Azure Key Vault, or applicable protected configuration services.
11+
// I am using the connection string in code for clarity and avoiding unnecessary logic that distracts from the focus of the demo.
12+
const string connectionString = "InstrumentationKey=<GUID>;IngestionEndpoint=https://<endpoint>.in.applicationinsights.azure.com/;LiveEndpoint=https://<endpoint>.livediagnostics.monitor.azure.com/";
13+
14+
#region Wire-up
15+
16+
//
17+
// Wire-up.
18+
//
19+
IServiceCollection services = new ServiceCollection();
20+
21+
// Add ApplicationInsightsLoggerProvider logger.
22+
services.AddLogging(loggingBuilder => loggingBuilder.AddFilter<ApplicationInsightsLoggerProvider>("Category", LogLevel.Information));
23+
24+
// Add Application Insights logic (ApplicationInsightsTelemetryWorkerService)
25+
services.AddApplicationInsightsTelemetryWorkerService((ApplicationInsightsServiceOptions options) => options.ConnectionString = connectionString);
26+
27+
28+
// NOTE: Injecting the SensitivityRedaction initializer.
29+
services.AddSingleton<ITelemetryInitializer, SensitivityRedactionTelemetryInitializer>();
30+
31+
32+
IServiceProvider serviceProvider = services.BuildServiceProvider();
33+
34+
#endregion
35+
36+
37+
//
38+
// NOTE: Program logic to demonstrate
39+
//
40+
41+
// Get the app insights ILogger from the service provider.
42+
ILogger<Program> logger = serviceProvider.GetRequiredService<ILogger<Program>>();
43+
44+
45+
// Sending a few log messages. Some include PII, some does not.
46+
logger.LogWarning("This is a log message without PII.");
47+
logger.LogWarning("This is a log message with an e-mail: [email protected]");
48+
logger.LogWarning("This is another message with [email protected], and [email protected]");
49+
logger.LogWarning("Users access restrictions changed for: [email protected];[email protected], new access level is 'Reader' on resource '123'");
50+
51+
52+
// For demo purposes in our console app.
53+
// Used to directly flush the buffer before we quit the app.
54+
var telemetryClient = serviceProvider.GetRequiredService<TelemetryClient>();
55+
telemetryClient.Flush();
56+
Task.Delay(5000).Wait();
57+

‎ApplicationInsights.RedactSensitiveInformation/ApplicationInsights.RedactSensitiveInformation/SensitivityRedactionTelemetryInitializer.cs‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
using Microsoft.ApplicationInsights.Channel;
2+
using Microsoft.ApplicationInsights.DataContracts;
3+
using Microsoft.ApplicationInsights.Extensibility;
4+
using System.Text.RegularExpressions;
5+
6+
namespace ApplicationInsights.RedactSensitiveInformation
7+
{
8+
/// <summary>
9+
/// Redacts standardized sensitive information from the trace messages.
10+
/// </summary>
11+
internal class SensitivityRedactionTelemetryInitializer : ITelemetryInitializer
12+
{
13+
public void Initialize(ITelemetry t)
14+
{
15+
var traceTelemetry = t as TraceTelemetry;
16+
if (traceTelemetry != null)
17+
{
18+
// Use Regex to replace any e-mail address with a replacement string.
19+
traceTelemetry.Message = Regex.Replace(traceTelemetry.Message, @"\w+([-+.]\w+)*@\w+([-.]\w+)*\.\w+([-.]\w+)*", "[PII REDACTED]");
20+
21+
// If we don't remove this CustomDimension, the telemetry message will still contain the PII in the "OriginalFormat" property.
22+
traceTelemetry.Properties.Remove("OriginalFormat");
23+
}
24+
}
25+
}
26+
}

‎DefenderDevOps/DefenderForDevOps/DefenderForDevOps.sln‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio Version 17
4+
VisualStudioVersion = 17.3.32929.385
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "DummyApp", "DummyApp\DummyApp.csproj", "{DAC34EDD-8B17-47A4-BC8A-38B960545DD7}"
7+
EndProject
8+
Global
9+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10+
Debug|Any CPU = Debug|Any CPU
11+
Release|Any CPU = Release|Any CPU
12+
EndGlobalSection
13+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
14+
{DAC34EDD-8B17-47A4-BC8A-38B960545DD7}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
15+
{DAC34EDD-8B17-47A4-BC8A-38B960545DD7}.Debug|Any CPU.Build.0 = Debug|Any CPU
16+
{DAC34EDD-8B17-47A4-BC8A-38B960545DD7}.Release|Any CPU.ActiveCfg = Release|Any CPU
17+
{DAC34EDD-8B17-47A4-BC8A-38B960545DD7}.Release|Any CPU.Build.0 = Release|Any CPU
18+
EndGlobalSection
19+
GlobalSection(SolutionProperties) = preSolution
20+
HideSolutionNode = FALSE
21+
EndGlobalSection
22+
GlobalSection(ExtensibilityGlobals) = postSolution
23+
SolutionGuid = {1006202C-5240-480B-B4AA-B5B69202EADC}
24+
EndGlobalSection
25+
EndGlobal

‎DefenderDevOps/DefenderForDevOps/DummyApp/DummyApp.csproj‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
<Project Sdk="Microsoft.NET.Sdk">
2+
3+
<PropertyGroup>
4+
<OutputType>Exe</OutputType>
5+
<TargetFramework>net6.0</TargetFramework>
6+
<ImplicitUsings>enable</ImplicitUsings>
7+
<Nullable>enable</Nullable>
8+
</PropertyGroup>
9+
10+
<ItemGroup>
11+
<PackageReference Include="Microsoft.IdentityModel.JsonWebTokens" Version="6.25.0" />
12+
</ItemGroup>
13+
14+
</Project>

‎DefenderDevOps/DefenderForDevOps/DummyApp/Program.cs‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
// See https://aka.ms/new-console-template for more information
2+
Console.WriteLine("Hello, World!");
3+
4+
// Dummy samples of secrets in code. CredScan should hopefully pick this up.
5+
var test1 = "DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=http://127.0.0.1:10000/devstoreaccount1;QueueEndpoint=http://127.0.0.1:10001/devstoreaccount1;TableEndpoint=http://127.0.0.1:10002/devstoreaccount1;";
6+
var test2 = "jdbc:postgresql://mydb.b5uacpxznijm.us-west-2.rds.amazonaws.com:5432/ebdb?user=username&password=mypassword";
7+
var sasTest = "BlobEndpoint=https://sastestdummy.blob.core.windows.net/;QueueEndpoint=https://sastestdummy.queue.core.windows.net/;FileEndpoint=https://sastestdummy.file.core.windows.net/;TableEndpoint=https://sastestdummy.table.core.windows.net/;SharedAccessSignature=sv=2021-06-08&ss=bfqt&srt=s&sp=rwdlacupiytfx&se=2022-11-01T02:08:27Z&st=2022-10-31T18:08:27Z&spr=https&sig=aEpff6lffaCfC2fiLvfOf%2FfP6f7rKyftJGfAdnfgf4wg%3D";
8+
9+
var azureTableStorageDummy = "DefaultEndpointsProtocol=https;AccountName=foobardumdum;AccountKey=h1QWNse3ydtVL2EGTreEMtldl7R132T1poLQdzXpV/t0j84lQphjf2MP78HrtiSYyQu6PTvAda0s+AStr+W4wg==;EndpointSuffix=core.windows.net";

‎DefenderDevOps/DefenderForDevOps/DummyApp/config.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{
2+
"azureConnectionStringDummy": "DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=https://sastestdummy.blob.core.windows.net/;QueueEndpoint=https://sastestdummy.queue.core.windows.net/;FileEndpoint=https://sastestdummy.file.core.windows.net/;TableEndpoint=https://sastestdummy.table.core.windows.net/",
3+
"sasCredentialDummy": "BlobEndpoint=https://sastestdummy.blob.core.windows.net/;QueueEndpoint=https://sastestdummy.queue.core.windows.net/;FileEndpoint=https://sastestdummy.file.core.windows.net/;TableEndpoint=https://sastestdummy.table.core.windows.net/;SharedAccessSignature=sv=2021-06-08&ss=bfqt&srt=s&sp=rwdlacupiytfx&se=2022-11-01T02:08:27Z&st=2022-10-31T18:08:27Z&spr=https&sig=aEpff6lffaCfC2fiLvfOf%2FfP6f7rKyftJGfAdnfgf4wg%3D",
4+
"awsDbDummy": "jdbc:postgresql://mydb.b5uacpxznijm.us-west-2.rds.amazonaws.com:5432/ebdb?user=username&password=mypassword"
5+
}

‎DefenderDevOps/dummy-arm-template.json‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
{
2+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
3+
"contentVersion": "1.0.0.0",
4+
"parameters": {
5+
"webAppName": {
6+
"type": "string",
7+
"defaultValue": "[concat('webApp-', uniqueString(resourceGroup().id))]",
8+
"minLength": 2,
9+
"metadata": {
10+
"description": "Web app name."
11+
}
12+
},
13+
"location": {
14+
"type": "string",
15+
"defaultValue": "[resourceGroup().location]",
16+
"metadata": {
17+
"description": "Location for all resources."
18+
}
19+
},
20+
"sku": {
21+
"type": "string",
22+
"defaultValue": "F1",
23+
"metadata": {
24+
"description": "The SKU of App Service Plan."
25+
}
26+
},
27+
"language": {
28+
"type": "string",
29+
"defaultValue": ".net",
30+
"allowedValues": [
31+
".net",
32+
"php",
33+
"node",
34+
"html"
35+
],
36+
"metadata": {
37+
"description": "The language stack of the app."
38+
}
39+
},
40+
"helloWorld": {
41+
"type": "bool",
42+
"defaultValue": false,
43+
"metadata": {
44+
"description": "true = deploy a sample Hello World app."
45+
}
46+
},
47+
"repoUrl": {
48+
"type": "string",
49+
"defaultValue": "",
50+
"metadata": {
51+
"description": "Optional Git Repo URL"
52+
}
53+
}
54+
},
55+
"variables": {
56+
"appServicePlanPortalName": "[concat('AppServicePlan-', parameters('webAppName'))]",
57+
"gitRepoReference": {
58+
".net": "https://github.com/Azure-Samples/app-service-web-dotnet-get-started",
59+
"node": "https://github.com/Azure-Samples/nodejs-docs-hello-world",
60+
"php": "https://github.com/Azure-Samples/php-docs-hello-world",
61+
"html": "https://github.com/Azure-Samples/html-docs-hello-world"
62+
},
63+
"gitRepoUrl": "[if(bool(parameters('helloWorld')), variables('gitRepoReference')[toLower(parameters('language'))], parameters('repoUrl'))]",
64+
"configReference": {
65+
".net": {
66+
"comments": ".Net app. No additional configuration needed."
67+
},
68+
"html": {
69+
"comments": "HTML app. No additional configuration needed."
70+
},
71+
"php": {
72+
"phpVersion": "7.4"
73+
},
74+
"node": {
75+
"appSettings": [
76+
{
77+
"name": "WEBSITE_NODE_DEFAULT_VERSION",
78+
"value": "12.15.0"
79+
}
80+
]
81+
}
82+
}
83+
},
84+
"resources": [
85+
{
86+
"type": "Microsoft.Web/serverfarms",
87+
"apiVersion": "2020-06-01",
88+
"name": "[variables('appServicePlanPortalName')]",
89+
"location": "[parameters('location')]",
90+
"sku": {
91+
"name": "[parameters('sku')]"
92+
}
93+
},
94+
{
95+
"type": "Microsoft.Web/sites",
96+
"apiVersion": "2020-06-01",
97+
"name": "[parameters('webAppName')]",
98+
"location": "[parameters('location')]",
99+
"dependsOn": [
100+
"[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanPortalName'))]"
101+
],
102+
"properties": {
103+
"siteConfig": "[variables('configReference')[parameters('language')]]",
104+
"serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanPortalName'))]"
105+
},
106+
"resources": [
107+
{
108+
"condition": "[contains(variables('gitRepoUrl'),'http')]",
109+
"type": "sourcecontrols",
110+
"apiVersion": "2020-06-01",
111+
"name": "web",
112+
"location": "[parameters('location')]",
113+
"dependsOn": [
114+
"[resourceId('Microsoft.Web/sites', parameters('webAppName'))]"
115+
],
116+
"properties": {
117+
"repoUrl": "[variables('gitRepoUrl')]",
118+
"branch": "master",
119+
"isManualIntegration": true
120+
}
121+
}
122+
]
123+
}
124+
]
125+
}

0 commit comments

Comments
 (0)