Implementation | Session 10: Red teaming, prompt injection, and Defender

Chapter 5 of 6

Implement#

1. Set runtime inputs#

Complete the root README environment setup. The runner uses azure-ai-projects 2.x and preview API 2025-11-15-preview.

PowerShell

$approvedSubscriptionId = $env:AZURE_SUBSCRIPTION_ID
$expectedRegion = $env:APPROVED_RED_TEAM_REGION
$authorizationReference = $env:APPROVED_RED_TEAM_AUTHORIZATION
$supportConfirmedOn = $env:RED_TEAM_SUPPORT_CONFIRMED_ON
$socRouteReference = $env:APPROVED_SOC_ROUTE
$taxonomyId = $env:APPROVED_FOUNDRY_TAXONOMY_ID
$env:FOUNDRY_RESOURCE_ID = $env:APPROVED_FOUNDRY_RESOURCE_ID
$env:FOUNDRY_PROJECT_ENDPOINT = $env:APPROVED_FOUNDRY_PROJECT_ENDPOINT
$env:FOUNDRY_MODEL_NAME = $env:APPROVED_RED_TEAM_MODEL
$env:FOUNDRY_BASELINE_AGENT_VERSION = $env:APPROVED_BASELINE_AGENT_VERSION
$postRemediationVersion = $env:APPROVED_REMEDIATED_AGENT_VERSION
$securityStore = $env:APPROVED_SECURITY_RECORD_STORE

Bash

approved_subscription_id="${AZURE_SUBSCRIPTION_ID:?Set AZURE_SUBSCRIPTION_ID.}"
expected_region="${APPROVED_RED_TEAM_REGION:?Set APPROVED_RED_TEAM_REGION.}"
authorization_reference="${APPROVED_RED_TEAM_AUTHORIZATION:?Set APPROVED_RED_TEAM_AUTHORIZATION.}"
support_confirmed_on="${RED_TEAM_SUPPORT_CONFIRMED_ON:?Set RED_TEAM_SUPPORT_CONFIRMED_ON.}"
soc_route_reference="${APPROVED_SOC_ROUTE:?Set APPROVED_SOC_ROUTE.}"
taxonomy_id="${APPROVED_FOUNDRY_TAXONOMY_ID:?Set APPROVED_FOUNDRY_TAXONOMY_ID.}"
export FOUNDRY_RESOURCE_ID="${APPROVED_FOUNDRY_RESOURCE_ID:?Set APPROVED_FOUNDRY_RESOURCE_ID.}"
export FOUNDRY_PROJECT_ENDPOINT="${APPROVED_FOUNDRY_PROJECT_ENDPOINT:?Set APPROVED_FOUNDRY_PROJECT_ENDPOINT.}"
export FOUNDRY_MODEL_NAME="${APPROVED_RED_TEAM_MODEL:?Set APPROVED_RED_TEAM_MODEL.}"
export FOUNDRY_BASELINE_AGENT_VERSION="${APPROVED_BASELINE_AGENT_VERSION:?Set APPROVED_BASELINE_AGENT_VERSION.}"
post_remediation_version="${APPROVED_REMEDIATED_AGENT_VERSION:?Set APPROVED_REMEDIATED_AGENT_VERSION.}"
security_store="${APPROVED_SECURITY_RECORD_STORE:?Set APPROVED_SECURITY_RECORD_STORE outside this repository.}"

2. Preflight and prepare the taxonomy#

PowerShell

.\scripts\preflight.ps1 `
  -ApprovedSubscriptionId $approvedSubscriptionId `
  -ExpectedRegion $expectedRegion `
  -AuthorizationReference $authorizationReference `
  -SupportConfirmedOn $supportConfirmedOn `
  -SocRouteReference $socRouteReference `
  -Phase PrepareTaxonomy

python .\scripts\run-red-team.py `
  --config .\artifacts\red-team\attack-plan.json `
  --prepare-taxonomy

Bash

./scripts/preflight.sh \
  --approved-subscription-id "$approved_subscription_id" \
  --expected-region "$expected_region" \
  --authorization-reference "$authorization_reference" \
  --support-confirmed-on "$support_confirmed_on" \
  --soc-route-reference "$soc_route_reference" \
  --phase prepare-taxonomy

python ./scripts/run-red-team.py \
  --config ./artifacts/red-team/attack-plan.json \
  --prepare-taxonomy

Preflight is read-only. The runner then creates the taxonomy in Foundry. Review it there and pass its current ID through the shell. Do not add the ID or generated content to this repository.

3. Run the baseline#

PowerShell

.\scripts\preflight.ps1 `
  -ApprovedSubscriptionId $approvedSubscriptionId `
  -ExpectedRegion $expectedRegion `
  -AuthorizationReference $authorizationReference `
  -SupportConfirmedOn $supportConfirmedOn `
  -SocRouteReference $socRouteReference `
  -TaxonomyId $taxonomyId `
  -Phase Baseline

python .\scripts\run-red-team.py `
  --config .\artifacts\red-team\attack-plan.json `
  --taxonomy-id $taxonomyId `
  --phase baseline `
  --output (Join-Path $securityStore "baseline-aggregate.json")

Bash

./scripts/preflight.sh \
  --approved-subscription-id "$approved_subscription_id" \
  --expected-region "$expected_region" \
  --authorization-reference "$authorization_reference" \
  --support-confirmed-on "$support_confirmed_on" \
  --soc-route-reference "$soc_route_reference" \
  --taxonomy-id "$taxonomy_id" \
  --phase baseline

python ./scripts/run-red-team.py \
  --config ./artifacts/red-team/attack-plan.json \
  --taxonomy-id "$taxonomy_id" \
  --phase baseline \
  --output "$security_store/baseline-aggregate.json"

4. Rerun the remediated version#

Before this session, the agent owner created a new immutable version. The tool owner kept writes absent or denied, the data owner kept synthetic sources read-only, and the release owner reran the Foundry evaluation gate guide gate. Do not edit the baseline or change the plan.

PowerShell

.\scripts\preflight.ps1 `
  -ApprovedSubscriptionId $approvedSubscriptionId `
  -ExpectedRegion $expectedRegion `
  -AuthorizationReference $authorizationReference `
  -SupportConfirmedOn $supportConfirmedOn `
  -SocRouteReference $socRouteReference `
  -TaxonomyId $taxonomyId `
  -PostRemediationVersion $postRemediationVersion `
  -Phase PostRemediation

python .\scripts\run-red-team.py `
  --config .\artifacts\red-team\attack-plan.json `
  --taxonomy-id $taxonomyId `
  --post-remediation-version $postRemediationVersion `
  --phase post-remediation `
  --output (Join-Path $securityStore "post-remediation-aggregate.json")

Bash

./scripts/preflight.sh \
  --approved-subscription-id "$approved_subscription_id" \
  --expected-region "$expected_region" \
  --authorization-reference "$authorization_reference" \
  --support-confirmed-on "$support_confirmed_on" \
  --soc-route-reference "$soc_route_reference" \
  --taxonomy-id "$taxonomy_id" \
  --post-remediation-version "$post_remediation_version" \
  --phase post-remediation

python ./scripts/run-red-team.py \
  --config ./artifacts/red-team/attack-plan.json \
  --taxonomy-id "$taxonomy_id" \
  --post-remediation-version "$post_remediation_version" \
  --phase post-remediation \
  --output "$security_store/post-remediation-aggregate.json"