# Day 4 Lab Assets

## Screenshots

Screenshot files for Day 4 lab PDFs. All screenshots are numbered sequentially starting from image-34 (continuing from Day 3).

| File | Description |
|------|-------------|
| `image-34.png` | EnableMonitoring pipeline stage showing Terraform plan output |
| `image-35.png` | Resource group showing new diagnostic setting resources |
| `image-36.png` | Azure Activity Log connector page in Microsoft Sentinel |
| `image-37.png` | Log Analytics workspace showing the Logs blade |
| `image-38.png` | App Service diagnostic settings page |
| `image-39.png` | Storage account diagnostic settings |
| `image-40.png` | KQL query results showing AzureDiagnostics HTTPLogs |
| `image-41.png` | Terminal showing curl commands with custom correlation IDs |
| `image-42.png` | KQL results showing requests grouped by correlation ID |
| `image-43.png` | Correlation ID trace across services |
| `image-44.png` | KQL results showing structured security event logs |
| `image-45.png` | Microsoft Sentinel onboarding page |
| `image-46.png` | Microsoft Sentinel workspace overview |
| `image-47.png` | Azure Activity Log connector page |
| `image-48.png` | Sentinel workbooks list |
| `image-49.png` | Hunting query results |
| `image-50.png` | KQL results showing available tables |
| `image-51.png` | KQL results showing request counts by HTTP status code |
| `image-52.png` | KQL results showing correlation ID trace |
| `image-53.png` | KQL results showing requests to internal backend |
| `image-54.png` | KQL results showing Key Vault audit events |
| `image-55.png` | KQL results showing Azure Activity Log entries |
| `image-56.png` | New analytics rule creation page |
| `image-57.png` | Analytics rule query test results |
| `image-58.png` | Terminal showing attack traffic generation |
| `image-59.png` | Incidents list in Sentinel |
| `image-60.png` | Security operations workbook |
| `image-61.png` | Asset inventory workbook |
| `image-62.png` | Sentinel workbook editor |
| `image-63.png` | Custom workbook with KQL-driven tiles |
| `image-64.png` | Monitoring coverage review workbook |

## Placeholder files

| File | Description |
|------|-------------|
| `PLACEHOLDERS.md` | Complete list of all screenshot placeholders with descriptions and capture notes |

## Total: 31 screenshots (image-34 through image-64)
