Source Zero: Fully Automated Endpoint Evaluations Part Two

### Overview In this presentation, Dan Corrally, a researcher at Optiv, delivers part two of a video series on creating fully automated endpoint evaluations. Building upon part one—which covered creating a custom API connector within Power Automate for Mandiant Security Validation—this installment focuses on provisioning automated infrastructure in Microsoft Azure using Azure Automation runbooks triggered by a Power Automate cloud flow.

### Key Topics - **Automated Workflow Triggers**: Initiating cloud workflows via email notifications with specific subject lines. - **Data Extraction via Regular Expressions**: Using connectors to extract parameters like owner, IP address, and test name from incoming email bodies. - **Azure Automation Integration**: Passing extracted variables into an Azure Automation runbook job. - **Infrastructure Provisioning**: Dynamically generating resource groups, virtual networks, subnets, and customized inbound security rules for testing and troubleshooting.

### Technical Details The Power Automate cloud flow triggers when a service address receives an email with the subject line "endpoint evaluation." It executes three simultaneous actions using a connector to a program named Plumsail, applying regular expressions to extract three variables: the owner, the source IP address, and the test name (along with vendor variables planned for later steps).

These values are passed as parameters into an Azure Automation runbook job (named "resource group" located in an RPA template resource group). The runbook authenticates to Azure and uses PowerShell commands to provision infrastructure in the Central US region. Resource naming follows a consistent pattern (`owner-test-resource_group`, virtual network names, subnet names). In addition to networking components, the runbook configures a custom security group labeled "rdp security group" with an inbound security rule permitting RDP access over port 3389 strictly from the source IP address specified in the email, enabling testers to troubleshoot the virtual machines if automated testing errors occur.

### Takeaways The automated workflow successfully bridges email input, Power Automate parsing, and Azure Automation to stand up dedicated testing infrastructure on demand with granular access control. Corrally notes that part three will expand on this foundation to cover automated Azure virtual machine creation, leveraging storage accounts and Azure Automation to deploy both the Mandiant Security Validation agent and specified endpoint vendor agents on the test VMs.