diff --git a/published-azurehound-application-user-guide/USER_GUIDE.md b/published-azurehound-application-user-guide/USER_GUIDE.md new file mode 100644 index 00000000..9b099cc6 --- /dev/null +++ b/published-azurehound-application-user-guide/USER_GUIDE.md @@ -0,0 +1,96 @@ +# Steps to Deploy the SpecterOps AzureHound Managed Application from the Azure Marketplace +1. Log in to the Azure Portal +2. In the Azure Portal, search and select Marketplace. +3. Use the search bar to find **SpecterOps AzureHound**. +Marketplace search for AzureHound + +4. From the search results, click on SpecterOps AzureHound to open the product page. +5. Click the "Create" button to begin the deployment process. +SpecterOps AzureHound Managed Application + + + +6. Configure Basic Settings : +- Choose the **Subscription** under which to deploy the application. +- Select or create a **Resource Group**. +- Enter a **Region** for deployment. +- Provide a name for your **Managed Application**, then click Next. +AzureHound Basic Config + + +### Steps to Register an Application in Microsoft Entra ID +- Sign in to the **Microsoft Entra** Admin Center. +- Navigate to **Entra ID** > **App registrations**. +- Click - **New registration**. +- Provide a meaningful Name for the Application (e.g., azurehound-client-app). +- Under Supported account types, select - **Accounts in this organizational directory only**. +- Click Register to create the Application. +- Once registration is complete, you'll be redirected to the application’s Overview page. +- Copy and save the **Application (client) ID** — you'll need it during deployment. + +### Create a new Application Secret +- Select App registrations and select your application from the list. +- Select **Certificates & secrets**. +- Select Client secrets, and then Select New client secret. +- Provide a description of the secret, and a duration. +- Select **Add**. + +### To obtain the BloodHound Token ID and Token Secret, follow these steps: +- Log in to your **BloodHound instance**. +- Navigate to **Administration** > **Manage Clients**. +- Click Create Client to generate a new Managed Client. +- Once created, copy the **Token ID** and **Token Secret** — these values will be used in the application deployment parameters. + +AzureHound Config + + +7. Fill in the required AzureHound Config Params: +- **Azure Tenant ID** - Your Azure Tenant ID. +- **Azure Application ID** - Register an application in Microsoft Entra ID, and grant it the Directory.Read.All, RoleManagement.Read.All API permissions and admin consent. + +Azure Client Graph Permission + + +- **Azure Secret ID** - Create a Client Secret for the registered app, and enter the secret value (not the ID). +- **BloodHound Instance Domain** - Enter your BloodHound instance domain name +- **BloodHound Token ID** - Enter the Managed Client Token ID. +- **BloodHound Token Secret** -Enter the Managed Client Token Secret. +- **Azure Function Package** - Enter URI to access the [Azure Function Package](https://saazurehounddev.blob.core.windows.net/azurefunction/containerRestartFunction.zip) + +8. Click Next, then Review + Create. +After validation, click Create to begin deployment. + + +## Start a job in Bloodhound + +After creating a Client in the Manage Clients section of BloodHound: +- Locate your client in the list. +- Click the menu icon (three horizontal lines) on the right side of the client row. +- Select On Demand Scan and click Run to start the job immediately. +- Optional - Schedule a Job (If you'd like AzureHound to run on a regular schedule) +Click Edit Client > Configure the Collection Schedule based on your preferred timing and frequency > Save the changes to apply the schedule. + +Create BloodHound Manage Client +Create AzureHound Client + +After the deployment is finished, you can check your managed application's status. +Navigate to the resource group you selected during the deployment. Under the Overview tab, you will find your deployed Managed Application listed among the resources. + +Resource group + +Click on your **deployed Managed Application** +Managed Application +Click on the Managed resource group, and you can see the resources deployed. + +## View Logs from the Deployed Container App +To monitor and troubleshoot your AzureHound deployment, you can access real-time logs from the container app: +- In the Managed resource group, in Resources, search for the container app and open the Container App resource. + +Container App + +- In the left-hand search bar within the Container App blade, type Log Stream and select it from the options. +- Set the Display to Real-Time. +- Under Category, select Application to view logs generated by the AzureHound application. +Container Log Stream + +By following the steps outlined in this guide, you can successfully deploy and configure AzureHound as a Managed Application in Microsoft Azure. This streamlined approach ensures minimal manual setup, secure integration with Azure services, and seamless visualization of Azure data within the BloodHound platform.