1. Initial Access¶

Access the signup portal¶

Open signup.cocoaman.cloud in your web browser to begin the lab.

Create your initial account with a unique username and a password that meets the requirements shown on the page. Record the full user principal name displayed after registration; you will use it to begin the investigation.

Enumerate the tenant with Cirro¶

Follow Using Cirro and CirroDash with the guest account you just created:

1. Authenticate Azure CLI to the workshop tenant.
2. Verify that az account show represents the new guest identity.
3. Run cirro collect az azcli.
4. Confirm that cirro_output.db exists and inspect its tables.
5. Copy it to initial-guest.db.
6. Ingest initial-guest.db into Neo4j.

This account may collect identity information without seeing the target subscription. Record that as the baseline rather than treating it as a tool failure.

Investigate the dashboard¶

Connect CirroDash to the same Neo4j instance used during ingestion. Confirm the Total nodes and Node types cards return results, then use a preconfigured user table or the generic search query from the tool guide to find your full user principal name.

Open the matching user node and follow its relationships to groups and role assignments. Save a table card for any Cypher query that helps explain the path; name it after the question it answers rather than the node type.

Your investigation should answer these questions:

1. Which group gives your account access to the subscription?
2. Is the group's membership assigned or dynamic?
3. Which user attribute and comparison determine membership?
4. Which Azure role is assigned to the group, and at what scope?

Pivot through dynamic membership¶

Return to the signup portal and create a second account whose user principal name satisfies the dynamic membership expression you discovered. Record the new account's full user principal name and sign in with that identity.

Repeat the complete workflow with the second identity: Azure login, Cirro collection, SQLite inspection, copy to defcon-reader.db, Neo4j ingestion, and CirroDash refresh. Compare the Total nodes card and resource tables with the initial collection.