2b) Add a Cloud Target

2b) Add a Cloud Target

A Cloud Target is a cloud environment that receives the events executed against cloud services.


During a simulation, the Attack Vector connects to the cloud environment over HTTPS and runs the cloud events of the scenario: you select a Cloud Target when you run a cloud scenario. Unlike a System Target, which is a machine reached over SSH, WinRM or WMI, a Cloud Target is reached with the identity of an application that you register in your tenant. See  Add a System Target  for machines.


Prepare your cloud environment

Credentials

Creating an Azure Cloud Target requires four pieces of information. A domain name can also be provided, but it is optional.
  • Tenant ID: the identifier of your Microsoft Entra tenant, shown on its Overview page in Microsoft Entra ID.
  • Subscription ID: the identifier of the Azure subscription that hosts the environment to test, listed under Subscriptions in the Azure portal.
  • Client ID: the Application (client) ID of the application you registered in Microsoft Entra ID for BlackNoise.
  • Client secret: a secret created for that application, under Certificates and secrets. Copy its value as soon as you create it, since Azure shows it only once, and plan its renewal before it expires.
The access you grant to the application on the subscription determines which events can actually run.

Network flows

The Attack Vector reaches Azure over HTTPS (TCP 443). Make sure outbound HTTPS from the Attack Vector to Azure is allowed by any firewall between them.


1. Create a Cloud Target

    Go to Resources and open the Cloud Targets page, listed under System Targets .
    Click the button that creates a Cloud Target.
    Fill in the required information: Tenant ID, Subscription ID, Client ID and Client secret. Add a domain name if you want to.
    Run a connection test if you want to check the target before creating it (see below), then confirm the creation.


2. Test the connection

Always test the connection between the Attack Vector and a new Cloud Target before running a simulation, to confirm that:
  • the HTTPS flow to Azure is open,
  • the credentials are correct.
You can test at two moments:
  • During creation , before the target is created.
  • Any time after , once the target exists.
The connection test also runs on the scope of a campaign when you create it, so the Cloud Target is checked again before the campaign starts. See  Security validation .