Skip to content

Commit f9f5d79

Browse files
emmanuelknafoemmanuelknafo
committed
Add README and lab documentation for Lab 06-ADO and Lab 07-ADO
- Created README.md files for Lab 06-ADO and Lab 07-ADO to outline screenshot placeholders and capture requirements. - Added comprehensive lab documentation for Lab 06-ADO, detailing the process of uploading SARIF results to Azure DevOps Advanced Security, including exercises on enabling Advanced Security, creating pipelines, and triaging findings. - Developed Lab 07-ADO documentation, focusing on building automated scanning pipelines, configuring cost gates, and managing deployment workflows with Azure DevOps YAML Pipelines.
1 parent c35d173 commit f9f5d79

8 files changed

Lines changed: 906 additions & 19 deletions

File tree

‎images/lab-06-ado/README.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
title: "Lab 06-ADO Screenshot Placeholders"
3+
description: "Screenshot inventory for Lab 06-ADO — SARIF and ADO Advanced Security."
4+
---
5+
6+
## Screenshots to Capture
7+
8+
This directory holds screenshots for Lab 06-ADO. Capture the following images
9+
during the lab and save them here with the exact filenames listed below.
10+
11+
| Filename | Description |
12+
|---|---|
13+
| `lab-06-ado-sarif-review.png` | SARIF file content review |
14+
| `lab-06-ado-pipeline-yaml.png` | ADO publish-sarif pipeline YAML |
15+
| `lab-06-ado-pipeline-run.png` | ADO pipeline run page |
16+
| `lab-06-ado-advsec-overview.png` | ADO Advanced Security Overview page |
17+
| `lab-06-ado-alert-detail.png` | Individual alert detail in ADO |
18+
| `lab-06-ado-compare-github.png` | Side-by-side comparison table (GitHub vs ADO) |

‎images/lab-07-ado/README.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
title: "Lab 07-ADO Screenshot Placeholders"
3+
description: "Screenshot inventory for Lab 07-ADO — ADO YAML Pipelines and Cost Gates."
4+
---
5+
6+
## Screenshots to Capture
7+
8+
This directory holds screenshots for Lab 07-ADO. Capture the following images
9+
during the lab and save them here with the exact filenames listed below.
10+
11+
| Filename | Description |
12+
|---|---|
13+
| `lab-07-ado-scan-pipeline.png` | FinOps scan pipeline YAML |
14+
| `lab-07-ado-wif-setup.png` | WIF service connection setup |
15+
| `lab-07-ado-pipeline-run.png` | ADO pipeline runs page |
16+
| `lab-07-ado-matrix-jobs.png` | ADO pipeline with matrix jobs expanded |
17+
| `lab-07-ado-variable-groups.png` | ADO variable groups page |
18+
| `lab-07-ado-cost-gate-pr.png` | ADO PR with Infracost comment |
19+
| `lab-07-ado-environment.png` | ADO environment approval gate |
20+
| `lab-07-ado-deploy-teardown.png` | ADO deploy pipeline runs page |

‎index.md‎

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,9 @@ Work through the labs in order. Labs 02–05 can be completed in parallel after
6767
- [ ] [Lab 04 — Cloud Custodian: Runtime Resource Scanning](labs/lab-04.md) _(40 min, Intermediate)_
6868
- [ ] [Lab 05 — Infracost: Cost Estimation and Budgeting](labs/lab-05.md) _(35 min, Intermediate)_
6969
- [ ] [Lab 06 — SARIF Output and GitHub Security Tab](labs/lab-06.md) _(30 min, Intermediate)_
70+
- [ ] [Lab 06-ADO — SARIF Output and ADO Advanced Security](labs/lab-06-ado.md) _(35 min, Intermediate)_
7071
- [ ] [Lab 07 — GitHub Actions Pipelines and Cost Gates](labs/lab-07.md) _(45 min, Advanced)_
72+
- [ ] [Lab 07-ADO — ADO YAML Pipelines and Cost Gates](labs/lab-07-ado.md) _(50 min, Advanced)_
7173

7274
## Lab Dependency Diagram
7375

@@ -78,27 +80,35 @@ graph LR
7880
L01 --> L03[Lab 03: Checkov]
7981
L01 --> L04[Lab 04: Cloud Custodian]
8082
L01 --> L05[Lab 05: Infracost]
81-
L02 --> L06[Lab 06: SARIF + Security Tab]
83+
L02 --> L06[Lab 06: SARIF + GitHub Security Tab]
8284
L03 --> L06
8385
L04 --> L06
8486
L05 --> L06
87+
L02 --> L06A[Lab 06-ADO: SARIF + ADO AdvSec]
88+
L03 --> L06A
89+
L04 --> L06A
90+
L05 --> L06A
8591
L06 --> L07[Lab 07: GitHub Actions + Cost Gates]
92+
L06A --> L07A[Lab 07-ADO: ADO Pipelines + Cost Gates]
8693
8794
classDef beginner fill:#107C10,stroke:#0b5e0b,color:#fff
8895
classDef intermediate fill:#0078D4,stroke:#005a9e,color:#fff
8996
classDef advanced fill:#D13438,stroke:#a4262c,color:#fff
9097
9198
class L00,L01 beginner
92-
class L02,L03,L04,L05,L06 intermediate
93-
class L07 advanced
99+
class L02,L03,L04,L05,L06,L06A intermediate
100+
class L07,L07A advanced
94101
```
95102

96103
## Delivery Tiers
97104

98-
| Tier | Labs | Duration | Azure Required |
99-
|------|------|----------|---------------|
100-
| Half-Day | 00, 01, 02, 03, 06 | ~3.5 hours | No |
101-
| Full-Day | 00–07 (all) | ~7.25 hours | Yes |
105+
| Tier | Platform | Labs | Duration | Azure Required |
106+
|------|----------|------|----------|---------------|
107+
| Half-Day (GitHub) | GitHub | 00, 01, 02, 03, 06 | ~3.5 hours | No |
108+
| Half-Day (ADO) | ADO | 00, 01, 02, 03, 06-ADO | ~3.5 hours | No |
109+
| Full-Day (GitHub) | GitHub | 00–07 (all GitHub) | ~7.25 hours | Yes |
110+
| Full-Day (ADO) | ADO | 00–05, 06-ADO, 07-ADO | ~7.75 hours | Yes |
111+
| Full-Day (Dual) | Both | 00–05, 06, 06-ADO, 07, 07-ADO | ~9.25 hours | Yes |
102112

103113
## Prerequisites
104114

‎labs/lab-06-ado.md‎

Lines changed: 237 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,237 @@
1+
---
2+
permalink: /labs/lab-06-ado
3+
title: "Lab 06-ADO - SARIF Output and ADO Advanced Security"
4+
description: "Upload SARIF scan results to Azure DevOps Advanced Security and triage findings."
5+
---
6+
7+
## Overview
8+
9+
| | |
10+
|---|---|
11+
| **Duration** | 35 minutes |
12+
| **Level** | Intermediate |
13+
| **Prerequisites** | [Lab 02](lab-02.md), [Lab 03](lab-03.md), [Lab 04](lab-04.md), or [Lab 05](lab-05.md) (at least one) |
14+
15+
## Learning Objectives
16+
17+
By the end of this lab, you will be able to:
18+
19+
* Explain how ADO Advanced Security (GHAzDO) ingests SARIF results
20+
* Enable Advanced Security at project and repository level
21+
* Create an ADO YAML pipeline with `AdvancedSecurity-Publish@1`
22+
* View and triage findings in the ADO Advanced Security Overview
23+
* Compare GitHub Security Tab with ADO Advanced Security
24+
25+
## Exercises
26+
27+
### Exercise 6.1: Review SARIF Output
28+
29+
You will review the SARIF v2.1.0 format that all four scanner tools produce.
30+
31+
> [!NOTE]
32+
> This exercise shares foundations with Lab 06 (GitHub variant). Complete [Lab 06 Exercise 6.1](lab-06.md#exercise-61-sarif-schema-deep-dive) if you haven't already. The following is a brief recap for the ADO track.
33+
34+
1. Open any SARIF file you generated in a previous lab (for example, `reports/psrule-001.sarif` or `reports/custodian.sarif`).
35+
36+
2. Recall the four main SARIF sections:
37+
38+
| Section | Purpose |
39+
|---------|---------|
40+
| `version` / `$schema` | Declares SARIF v2.1.0 compliance |
41+
| `runs[].tool.driver` | Identifies the scanner tool, version, and rule definitions |
42+
| `runs[].tool.driver.rules[]` | Defines rule IDs, descriptions, severity, and help URLs |
43+
| `runs[].results[]` | Contains individual findings with rule ID, severity, message, and location |
44+
45+
3. Note how `physicalLocation` ties a finding to a specific file and line number. ADO Advanced Security uses this location data to surface findings in the security overview and link them to source files.
46+
47+
4. Verify that your SARIF file includes at least one result with a `ruleId`, `level`, `message`, and `locations` array. ADO Advanced Security requires these fields to display alerts correctly.
48+
49+
![SARIF file content review](../images/lab-06-ado/lab-06-ado-sarif-review.png)
50+
51+
> [!TIP]
52+
> SARIF (Static Analysis Results Interchange Format) is an OASIS standard. Both GitHub and Azure DevOps Advanced Security consume SARIF files, so producing SARIF from all 4 tools gives you a unified view regardless of which platform you use.
53+
54+
### Exercise 6.2: Enable ADO Advanced Security
55+
56+
You will enable Advanced Security (GHAzDO) in the `MngEnvMCAP675646/FinOps` project.
57+
58+
> [!IMPORTANT]
59+
> ADO Advanced Security requires appropriate licensing. Your organization must have GitHub Advanced Security for Azure DevOps (GHAzDO) enabled. Contact your organization administrator if the toggle is not available.
60+
61+
1. Open Azure DevOps and navigate to the `MngEnvMCAP675646` organization.
62+
63+
2. Select the **FinOps** project.
64+
65+
3. Click **Project Settings** (bottom-left gear icon).
66+
67+
4. Under **Repos**, click **Repositories**.
68+
69+
5. Select the repository where you want to enable Advanced Security (for example, `finops-demo-app-001`).
70+
71+
6. Click the **Settings** tab for the repository.
72+
73+
7. Scroll to the **Advanced Security** section and toggle it **On**.
74+
75+
8. Repeat for each repository that should report SARIF findings. You can also enable it at the project level to cover all repositories:
76+
- Go back to **Project Settings → Repos → Repositories**
77+
- Click **Settings** at the project level
78+
- Toggle **Advanced Security** to **On** for all repos
79+
80+
9. Verify the toggle is active. You should see a confirmation message that Advanced Security is enabled.
81+
82+
> [!NOTE]
83+
> Enabling Advanced Security at the project level automatically enables it for all current and future repositories in the project. Per-repo settings override the project default if you need to exclude specific repos.
84+
85+
### Exercise 6.3: Create SARIF Publish Pipeline
86+
87+
You will create an ADO YAML pipeline that uploads SARIF results to Advanced Security using the `AdvancedSecurity-Publish@1` task.
88+
89+
1. In your repository, create the pipeline file at `.azuredevops/pipelines/publish-sarif.yml`:
90+
91+
```yaml
92+
trigger: none
93+
94+
pool:
95+
vmImage: 'ubuntu-latest'
96+
97+
steps:
98+
- task: AdvancedSecurity-Publish@1
99+
displayName: 'Publish SARIF to ADO Advanced Security'
100+
inputs:
101+
SarifsInputDirectory: '$(Build.SourcesDirectory)/results'
102+
```
103+
104+
2. The pipeline uses `trigger: none` so it runs only on manual trigger or when called from another pipeline.
105+
106+
3. The `AdvancedSecurity-Publish@1` task scans the specified directory for `.sarif` files and uploads them to ADO Advanced Security. Place your SARIF files in the `results/` directory at the repository root.
107+
108+
4. Register the pipeline in ADO:
109+
- Navigate to **Pipelines → Pipelines** in the FinOps project
110+
- Click **New Pipeline**
111+
- Select **Azure Repos Git** as the source
112+
- Select the repository containing the YAML file
113+
- Choose **Existing Azure Pipelines YAML file**
114+
- Set the path to `.azuredevops/pipelines/publish-sarif.yml`
115+
- Click **Save** (not Run — you will run it in the next exercise)
116+
117+
![ADO publish-sarif pipeline YAML](../images/lab-06-ado/lab-06-ado-pipeline-yaml.png)
118+
119+
> [!TIP]
120+
> The `AdvancedSecurity-Publish@1` task is the ADO equivalent of GitHub's `github/codeql-action/upload-sarif@v4`. Both consume SARIF files, but the ADO task publishes directly to the ADO Advanced Security backend rather than the GitHub Code Scanning API.
121+
122+
### Exercise 6.4: Run Pipeline and Upload SARIF
123+
124+
You will queue the publish-sarif pipeline and upload SARIF results to ADO Advanced Security.
125+
126+
1. Make sure you have at least one `.sarif` file in the `results/` directory of your repository. You can copy a file from a previous lab:
127+
128+
```bash
129+
mkdir -p results
130+
cp reports/psrule-001.sarif results/
131+
git add results/
132+
git commit -m "chore: add SARIF results for ADO upload"
133+
git push
134+
```
135+
136+
2. Queue the pipeline from the ADO web UI:
137+
- Navigate to **Pipelines → Pipelines**
138+
- Find the **publish-sarif** pipeline
139+
- Click **Run pipeline**
140+
- Select the branch containing your SARIF files
141+
- Click **Run**
142+
143+
3. Alternatively, trigger the pipeline from the command line:
144+
145+
```bash
146+
az pipelines run --name publish-sarif --organization https://dev.azure.com/MngEnvMCAP675646 --project FinOps
147+
```
148+
149+
4. Monitor the pipeline execution. Click on the running pipeline to see the job logs.
150+
151+
5. Verify the `AdvancedSecurity-Publish@1` step completed successfully. The logs should show the number of SARIF files processed and results uploaded.
152+
153+
![ADO pipeline run page](../images/lab-06-ado/lab-06-ado-pipeline-run.png)
154+
155+
> [!NOTE]
156+
> If the pipeline fails with a permissions error, verify that Advanced Security is enabled for the repository (Exercise 6.2) and that the pipeline has the required permissions to publish security results.
157+
158+
### Exercise 6.5: View ADO Advanced Security Overview
159+
160+
You will navigate to the ADO Advanced Security overview to review the uploaded findings.
161+
162+
1. In the FinOps project, navigate to **Repos** in the left sidebar.
163+
164+
2. Click **Advanced Security** to open the security overview.
165+
166+
3. Review the findings dashboard. Findings are grouped by:
167+
- **Severity** — Critical, High, Medium, Low
168+
- **Tool** — the scanner that produced the finding
169+
- **State** — Active, Dismissed
170+
171+
4. Click on an individual alert to see the detail view:
172+
- Rule ID and description
173+
- Severity level
174+
- Source file location with line number
175+
- First detected and last seen timestamps
176+
177+
5. Use the **State** dropdown on an alert to triage it:
178+
- **Active** — the finding needs attention
179+
- **Dismissed** — mark as false positive or won't fix
180+
181+
6. Use the filter controls at the top to narrow results by severity, tool, or state.
182+
183+
![ADO Advanced Security Overview page](../images/lab-06-ado/lab-06-ado-advsec-overview.png)
184+
185+
![Individual alert detail in ADO](../images/lab-06-ado/lab-06-ado-alert-detail.png)
186+
187+
> [!TIP]
188+
> ADO Advanced Security retains alert history across pipeline runs. If you fix a violation and re-scan, the alert state changes to **Fixed** automatically. This is similar to how GitHub Code Scanning tracks alert lifecycle across commits.
189+
190+
### Exercise 6.6: Compare GitHub vs ADO
191+
192+
You will compare the security alert experience across both platforms.
193+
194+
Review the following comparison table:
195+
196+
| Feature | GitHub | Azure DevOps |
197+
|---------|--------|--------------|
198+
| SARIF Upload | REST API / `codeql-action/upload-sarif@v4` | `AdvancedSecurity-Publish@1` |
199+
| Alert Viewer | Security Tab → Code Scanning | Repos → Advanced Security |
200+
| Alert Triage | Dismiss dropdown (false positive, won't fix, used in tests) | State management (Active, Dismissed) |
201+
| Auto-Fix | Dependabot / Copilot Autofix | Not available |
202+
| PR Integration | Check runs + status checks | Branch policies |
203+
| API Access | Code Scanning REST API | ADO REST API |
204+
205+
Key differences to note:
206+
207+
1. **Upload mechanism** — GitHub uses a REST API with gzip+base64 encoding. ADO uses a dedicated pipeline task that reads SARIF files from a directory.
208+
209+
2. **Triage granularity** — GitHub offers three dismiss reasons (false positive, won't fix, used in tests). ADO uses a simpler Active/Dismissed state model.
210+
211+
3. **Auto-remediation** — GitHub has Dependabot and Copilot Autofix for automated fixes. ADO Advanced Security does not offer automated fix suggestions.
212+
213+
4. **PR integration** — GitHub uses check runs and status checks. ADO uses branch policies that can gate PR completion on security findings.
214+
215+
5. **Both platforms** consume the same SARIF v2.1.0 standard, so you can use the same scanner output for both.
216+
217+
![Side-by-side comparison table](../images/lab-06-ado/lab-06-ado-compare-github.png)
218+
219+
> [!IMPORTANT]
220+
> In a dual-platform environment, run your scanners once and upload the same SARIF output to both GitHub and ADO. This eliminates result divergence and ensures consistent governance across platforms.
221+
222+
## Verification Checkpoint
223+
224+
Before proceeding, verify:
225+
226+
* [ ] Can describe how ADO Advanced Security ingests SARIF results
227+
* [ ] Enabled Advanced Security on at least one repository
228+
* [ ] Created and ran the publish-sarif pipeline successfully
229+
* [ ] Viewed and triaged findings in the ADO Advanced Security Overview
230+
* [ ] Can articulate 3 differences between GitHub Security Tab and ADO Advanced Security
231+
232+
## Next Steps
233+
234+
Continue to [Lab 07-ADO — ADO YAML Pipelines and Cost Gates](lab-07-ado.md).
235+
236+
> [!NOTE]
237+
> For the GitHub variant of this lab, see [Lab 06 — SARIF Output and GitHub Security Tab](lab-06.md).

‎labs/lab-06.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@ description: "Understand SARIF format and upload scan results to the GitHub Secu
1212
| **Level** | Intermediate |
1313
| **Prerequisites** | [Lab 02](lab-02.md), [Lab 03](lab-03.md), [Lab 04](lab-04.md), or [Lab 05](lab-05.md) (at least one) |
1414

15+
> [!TIP]
16+
> **Using Azure DevOps?** See [Lab 06-ADO — SARIF Output and ADO Advanced Security](lab-06-ado.md) for the ADO variant of this lab.
17+
1518
## Learning Objectives
1619

1720
By the end of this lab, you will be able to:

0 commit comments

Comments
 (0)