# Screenshot Placeholders — Day 4

Screenshots for Day 4 lab files. Numbered starting from image-34 (continuing from Day 3).

| File | Image | Description |
|------|-------|-------------|
| lab-4-1-pipeline-baseline.typ | image-34.png | EnableMonitoring pipeline stage showing Terraform plan output |
| lab-4-1-pipeline-baseline.typ | image-35.png | Resource group showing new diagnostic setting resources alongside Day 3 resources |
| lab-4-1-pipeline-baseline.typ | image-36.png | Azure Activity Log connector page in Microsoft Sentinel showing the Apply button |
| lab-4-2-log-analytics-diagnostic-settings.typ | image-37.png | Log Analytics workspace showing the Logs blade |
| lab-4-2-log-analytics-diagnostic-settings.typ | image-38.png | App Service diagnostic settings page showing the Add diagnostic setting button |
| lab-4-2-log-analytics-diagnostic-settings.typ | image-39.png | Storage account diagnostic settings showing enabled log categories |
| lab-4-2-log-analytics-diagnostic-settings.typ | image-40.png | KQL query results showing AzureDiagnostics HTTPLogs |
| lab-4-3-application-telemetry.typ | image-41.png | Terminal showing curl commands with custom correlation IDs |
| lab-4-3-application-telemetry.typ | image-42.png | KQL results showing requests grouped by correlation ID |
| lab-4-3-application-telemetry.typ | image-43.png | Correlation ID trace showing request flowing through public backend to internal backend |
| lab-4-3-application-telemetry.typ | image-44.png | KQL results showing structured security event logs and request timing data |
| lab-4-4-enable-sentinel.typ | image-45.png | Microsoft Sentinel onboarding page showing the Log Analytics workspace selection |
| lab-4-4-enable-sentinel.typ | image-46.png | Microsoft Sentinel workspace overview showing the left navigation menu |
| lab-4-4-enable-sentinel.typ | image-47.png | Azure Activity Log connector page in Microsoft Sentinel |
| lab-4-4-enable-sentinel.typ | image-48.png | Sentinel workbooks list showing built-in workbook templates |
| lab-4-4-enable-sentinel.typ | image-49.png | Hunting query results showing anonymous IP address queries |
| lab-4-5-kql-hunting.typ | image-50.png | KQL results showing available tables in Log Analytics |
| lab-4-5-kql-hunting.typ | image-51.png | KQL results showing request counts by HTTP status code |
| lab-4-5-kql-hunting.typ | image-52.png | KQL results showing correlation ID trace across services |
| lab-4-5-kql-hunting.typ | image-53.png | KQL results showing requests to internal backend endpoints |
| lab-4-5-kql-hunting.typ | image-54.png | KQL results showing Key Vault audit events |
| lab-4-5-kql-hunting.typ | image-55.png | KQL results showing Azure Activity Log entries |
| lab-4-6-analytics-rule-incident.typ | image-56.png | New analytics rule creation page in Sentinel |
| lab-4-6-analytics-rule-incident.typ | image-57.png | Analytics rule query test showing detection results |
| lab-4-6-analytics-rule-incident.typ | image-58.png | Terminal showing curl commands generating attack traffic against the internal backend |
| lab-4-6-analytics-rule-incident.typ | image-59.png | Incidents list showing the newly created incident |
| lab-4-7-workbook-review.typ | image-60.png | Security operations workbook showing incident overview and MITRE ATT&CK coverage |
| lab-4-7-workbook-review.typ | image-61.png | Asset inventory workbook showing resources by type and data freshness |
| lab-4-7-workbook-review.typ | image-62.png | Sentinel workbook editor showing the create from scratch option |
| lab-4-7-workbook-review.typ | image-63.png | Custom workbook showing error rate chart and top offending IPs tile |
| lab-4-7-workbook-review.typ | image-64.png | Monitoring coverage review workbook showing active data sources and gaps |

Total: 31 screenshot placeholders (image-34 through image-64)

## Notes for screenshot capture

- All screenshots should be taken in the Azure portal with the dark theme disabled (light theme preferred for readability)
- Include the browser URL bar and portal navigation to provide context
- Blur or redact subscription IDs, resource group names, and any sensitive data
- Use a consistent resolution (1920x1080 or wider)
- Annotate key UI elements with arrows or highlights where helpful
- Take screenshots after the pipeline has completed and data has propagated (wait 2-3 minutes after telemetry generation)
- For KQL query results, include the query editor showing the full KQL query above the results grid
