Lab¶

Complete each section of the lab in order.

Before starting, complete Using Cirro and CirroDash. Keep that page open as the tool reference for collection, ingestion, graph refresh, dashboard cards, and troubleshooting.

Sections¶

1. Initial Access
2. Virtual Machine Pivot
3. Key Vault Credential
4. Global Reader and Path Review

Investigation model¶

At each stage, move past a flat resource inventory. Record both the objects you find and the relationships that make them useful. In particular, ask what each resource:

• contains;
• references or downloads;
• executes or configures; and
• can authenticate as.