🔄 Workshop 4 — The Grand Finale
Workshop 4 of 4 — The Grand Finale of the Agentic DevSecOps Series
| Workshop | Focus | |
|---|---|---|
| 🛡️ | WS1 — Trust Boundary & Platform Trust | WHERE does development happen? |
| 🔒 | WS2 — Secure by Design Guardrails | WHAT prevents bad code from landing? |
| 🔗 | WS3 — Supply Chain Integrity & Code-to-Cloud Visibility | HOW do we trust the delivery path? |
| 🔄 | WS4 — Operational Response & Continuous Improvement (YOU ARE HERE — FINALE) | WHAT happens when things go wrong? |
DevSecOps doesn’t end at deployment. In this final workshop, you detect a runtime incident, measure your Mean Time To Resolution (MTTR) with AI-assisted remediation, and execute 5 concrete feedback actions that strengthen every layer built in Workshops 1–3 — proving that DevSecOps is a closed-loop operating model.
Thesis: “DevSecOps doesn’t end at deployment. Response feeds back into design, policy, and detection — closing the loop.”
💡 Key Insight: “DevSecOps is not a set of tools. It is a closed-loop operating model.”
NIST SSDF Alignment
This workshop maps to RV — Respond to Vulnerabilities in the NIST Secure Software Development Framework:
| NIST SSDF Group | Workshop | Focus |
|---|---|---|
| PO — Define Security Requirements | WS1 🛡️ | Trust boundary, org policies, platform trust |
| PW — Produce Well-Secured Software | WS2 🔒 | Code scanning, secret scanning, guardrails |
| PS — Protect the Software Supply Chain | WS3 🔗 | OIDC, attestations, Defender visibility |
| RV — Respond to Vulnerabilities | WS4 🔄 | Runtime detection, MTTR, continuous improvement |
📚 Curriculum
| Step | Title | Duration |
|---|---|---|
| Setup | Environment Setup | ~10 min |
| 1 | Runtime Incident Detection | ~10 min |
| 2 | AI-Assisted Investigation & Remediation | ~15 min |
| 3 | Continuous Improvement Loop (Grand Finale) | ~12 min |
🎯 Learning Objectives
By the end of this workshop, you will be able to:
- Detect a runtime incident using SRE Agent and correlate it with Defender for Cloud
- Measure Mean Time To Resolution (MTTR) with timestamps at each response phase (T0 Alert → T5 Resolved)
- Use Copilot coding agent to accelerate incident remediation while maintaining human approval at every gate
- Execute concrete continuous improvement actions — update rulesets, custom instructions, tests, and the threat model
- Verify the improvement loop closes — the same incident class is caught earlier on subsequent occurrence
💬 Discussion Prompts
Use these questions for team reflection after completing the exercises:
-
MTTR Reality Check: “We measured MTTR in this exercise. What’s your team’s current MTTR for production incidents? Where are the biggest time sinks — detection, investigation, approval, or deployment?”
-
NIST Compliance: “NIST SSDF RV.3 requires root cause analysis. How would you ensure that incident learnings actually reach the developers who need them — not just the SRE team?”
-
AI Autonomy Boundaries: “SRE Agent and Copilot both proposed actions that required human approval. In what scenarios would you be comfortable increasing AI autonomy? Where would you never do so?”
-
Automation Risks: “If this feedback loop ran automatically — incident → Copilot PR → auto-merge → redeploy — what could go wrong? What safeguards would you need?”
🚀 Optional Extensions
| Extension | Description | Time |
|---|---|---|
| A. Incident Report Generation | Compile the MTTR timeline into a structured incident report for compliance | ~15 min |
| B. PagerDuty / Slack Integration | Configure SRE Agent alert routing to your team’s incident management tools | ~10 min |
| C. Multi-Incident Comparison | Stage a second, different incident → measure MTTR → compare with first | ~20 min |
| D. Automated Regression Suite | Build a full manifest validation pipeline with OPA/Gatekeeper policies | ~20 min |
📖 References
| Resource | Link |
|---|---|
| GitHub Copilot Coding Agent | docs.github.com |
| GitHub Custom Instructions | docs.github.com |
| GitHub Security Campaigns | docs.github.com |
| NIST SP 800-218 (SSDF) | csrc.nist.gov |
| NIST SP 800-218A (AI & SSDF) | csrc.nist.gov |
| Azure SRE Agent | learn.microsoft.com |
| Microsoft Defender for Cloud | learn.microsoft.com |
| Kubernetes Probes | kubernetes.io |
🔄 Series Conclusion
“We started by defining WHERE development trust lives. We built guardrails to prevent bad code. We secured the pipeline and gained visibility. And now we’ve closed the loop — every incident makes the entire system stronger.”
This is Agentic DevSecOps.
WS1 🛡️ Trust Boundary & Platform Trust
WS2 🔒 Secure by Design Guardrails
WS3 🔗 Supply Chain Integrity & Code-to-Cloud Visibility
WS4 🔄 Operational Response & Continuous Improvement ← COMPLETE