Azure
/
Azure-Sentinel
зеркало из
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность
Azure-Sentinel/Playbooks/Notify-ASCAlertAzureResource/azuredeploy.json

554 строки
32 KiB
JSON
Исходник Обычный вид История

New Azure Sentinel Playbook This playbook will notify all mail enabled users assigned RBAC on the Azure Resource via a ASC alert generated Sentinel Incident
2020-02-26 02:10:30 +03:00
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"metadata":{
Updates to Notify playbook - notifies owners and contributors - includes mail enabled security groups - includes user or groups with otherMails property
2020-03-08 22:05:20 +03:00
"comments": "This playbook will notify RBAC assigned Owners and Contributors both user and mail enabled security groups on the Azure Resource via a ASC alert generated Sentinel Incident.",
New Azure Sentinel Playbook This playbook will notify all mail enabled users assigned RBAC on the Azure Resource via a ASC alert generated Sentinel Incident
2020-02-26 02:10:30 +03:00
"author": "Nathan Swift"
},
"parameters": {
"PlaybookName": {
defvalue parameter change default value to reflect proper name
2020-02-26 17:30:57 +03:00
"defaultValue": "Notify-ASCAlertAzureResource",
New Azure Sentinel Playbook This playbook will notify all mail enabled users assigned RBAC on the Azure Resource via a ASC alert generated Sentinel Incident
2020-02-26 02:10:30 +03:00
"type": "String"
},
"UserName": {
"defaultValue": "<username>@<domain>",
"type": "string"
},
"AzureSentinelLogAnalyticsWorkspaceName": {
"defaultValue": "yourAzureSentinelworkspacename",
"type": "string"
},
"AzureSentinelLogAnalyticsWorkspaceResourceGroupName": {
"defaultValue": "yourAzureSentinelworkspaceRGname",
"type": "string"
},
"AADTenantID": {
"defaultValue": "Your AAD Tenant ID",
"type": "string"
}
},
"variables": {
"AzureMonitorLogsConnectionName": "[concat('azuremonitorlogs-', parameters('PlaybookName'))]",
"AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]",
"office365ConnectionName": "[concat('office365-', parameters('PlaybookName'))]"
},
"resources": [
{
"type": "Microsoft.Web/connections",
"apiVersion": "2016-06-01",
"name": "[variables('AzureSentinelConnectionName')]",
"location": "[resourceGroup().location]",
"properties": {
"displayName": "[parameters('UserName')]",
"customParameterValues": {},
"api": {
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
}
}
},
{
"type": "Microsoft.Web/connections",
"apiVersion": "2016-06-01",
"name": "[variables('AzureMonitorLogsConnectionName')]",
"location": "[resourceGroup().location]",
"properties": {
"displayName": "[parameters('UserName')]",
"customParameterValues": {},
"api": {
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuremonitorlogs')]"
}
}
},
{
"type": "Microsoft.Web/connections",
"apiVersion": "2016-06-01",
"name": "[variables('office365ConnectionName')]",
"location": "[resourceGroup().location]",
"properties": {
"displayName": "[parameters('UserName')]",
"customParameterValues": {},
"api": {
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/office365')]"
}
}
},
{
"type": "Microsoft.Logic/workflows",
"apiVersion": "2017-07-01",
"name": "[parameters('PlaybookName')]",
"location": "[resourceGroup().location]",
"tags": {
"LogicAppsCategory": "security"
},
Updates to Notify playbook - notifies owners and contributors - includes mail enabled security groups - includes user or groups with otherMails property
2020-03-08 22:05:20 +03:00
"identity": {
"type": "SystemAssigned"
},
"dependsOn": [
"[resourceId('Microsoft.Web/connections', variables('office365ConnectionName'))]",
"[resourceId('Microsoft.Web/connections', variables('AzureMonitorLogsConnectionName'))]",
"[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]"
],
New Azure Sentinel Playbook This playbook will notify all mail enabled users assigned RBAC on the Azure Resource via a ASC alert generated Sentinel Incident
2020-02-26 02:10:30 +03:00
"properties": {
"state": "Enabled",
"definition": {
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"$connections": {
"defaultValue": {},
"type": "Object"
},
"TenantID": {
"defaultValue": "[parameters('AADTenantID')]",
"type": "String"
}
},
"triggers": {
Update playbook trigger names
2022-02-22 18:02:56 +03:00
"Microsoft_Sentinel_alert": {
New Azure Sentinel Playbook This playbook will notify all mail enabled users assigned RBAC on the Azure Resource via a ASC alert generated Sentinel Incident
2020-02-26 02:10:30 +03:00
"type": "ApiConnectionWebhook",
"inputs": {
"body": {
"callback_url": "@{listCallbackUrl()}"
},
"host": {
"connection": {
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
}
},
"path": "/subscribe"
}
}
},
"actions": {
"Alert_-_Get_incident": {
"runAfter": {},
"type": "ApiConnection",
"inputs": {
"host": {
"connection": {
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
}
},
"method": "get",
"path": "/Cases/@{encodeURIComponent(triggerBody()?['SystemAlertId'])}/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}"
}
},
"For_each": {
"foreach": "@body('Alert_-_Get_incident')?['properties']?['RelatedAlertIds']",
"actions": {
"Filter_array": {
"runAfter": {
"HTTP_2": [
"Succeeded"
]
},
"type": "Query",
"inputs": {
"from": "@body('HTTP_2')?['value']",
Updates to Notify playbook - notifies owners and contributors - includes mail enabled security groups - includes user or groups with otherMails property
2020-03-08 22:05:20 +03:00
"where": "@or(not(equals(item()?['mail'], null)), not(equals(item()?['otherMails'], null)))"
}
},
"Filter_array_2": {
"runAfter": {
"HTTP": [
"Succeeded"
]
},
"type": "Query",
"inputs": {
"from": "@body('HTTP')?['value']",
"where": "@or(contains(item()?['properties']?['roleDefinitionId'], '8e3af657-a8ff-443c-a75c-2fe8c4bcb635'), contains(item()?['properties']?['roleDefinitionId'], 'b24988ac-6180-42a0-ab88-20f7382dd24c'))"
New Azure Sentinel Playbook This playbook will notify all mail enabled users assigned RBAC on the Azure Resource via a ASC alert generated Sentinel Incident
2020-02-26 02:10:30 +03:00
}
},
"For_each_2": {
Updates to Notify playbook - notifies owners and contributors - includes mail enabled security groups - includes user or groups with otherMails property
2020-03-08 22:05:20 +03:00
"foreach": "@body('Filter_array_2')",
New Azure Sentinel Playbook This playbook will notify all mail enabled users assigned RBAC on the Azure Resource via a ASC alert generated Sentinel Incident
2020-02-26 02:10:30 +03:00
"actions": {
"Append_to_array_variable": {
"runAfter": {},
"type": "AppendToArrayVariable",
"inputs": {
"name": "simpleassignarray",
"value": "@items('For_each_2')?['properties']?['principalId']"
}
}
},
"runAfter": {
Updates to Notify playbook - notifies owners and contributors - includes mail enabled security groups - includes user or groups with otherMails property
2020-03-08 22:05:20 +03:00
"Filter_array_2": [
New Azure Sentinel Playbook This playbook will notify all mail enabled users assigned RBAC on the Azure Resource via a ASC alert generated Sentinel Incident
2020-02-26 02:10:30 +03:00
"Succeeded"
]
},
"type": "Foreach"
},
"For_each_3": {
"foreach": "@body('Filter_array')",
"actions": {
Updates to Notify playbook - notifies owners and contributors - includes mail enabled security groups - includes user or groups with otherMails property
2020-03-08 22:05:20 +03:00
"Condition": {
"actions": {
"Append_to_string_variable": {
"runAfter": {},
"type": "AppendToStringVariable",
"inputs": {
"name": "emailstring",
"value": "@{items('For_each_3')?['mail']}; "
}
}
},
New Azure Sentinel Playbook This playbook will notify all mail enabled users assigned RBAC on the Azure Resource via a ASC alert generated Sentinel Incident
2020-02-26 02:10:30 +03:00
"runAfter": {},
Updates to Notify playbook - notifies owners and contributors - includes mail enabled security groups - includes user or groups with otherMails property
2020-03-08 22:05:20 +03:00
"else": {
"actions": {
"For_each_4": {
"foreach": "@items('For_each_3')?['otherMails']",
"actions": {
"Condition_2": {
"actions": {
"Append_to_string_variable_2": {
"runAfter": {},
"type": "AppendToStringVariable",
"inputs": {
"name": "emailstring",
"value": "@{items('For_each_4')}; "
}
}
},
"runAfter": {},
"expression": {
"and": [
{
"not": {
"equals": [
"@items('For_each_4')",
"@null"
]
}
}
]
},
"type": "If"
}
},
"runAfter": {},
"type": "Foreach"
}
}
},
"expression": {
"and": [
{
"not": {
"equals": [
"@items('For_each_3')?['mail']",
"@null"
]
}
}
]
},
"type": "If"
New Azure Sentinel Playbook This playbook will notify all mail enabled users assigned RBAC on the Azure Resource via a ASC alert generated Sentinel Incident
2020-02-26 02:10:30 +03:00
}
},
"runAfter": {
"Filter_array": [
"Succeeded"
]
},
"type": "Foreach"
},
"HTTP": {
"runAfter": {
"Parse_JSON": [
"Succeeded"
]
},
"type": "Http",
"inputs": {
"authentication": {
"audience": "https://management.azure.com",
"type": "ManagedServiceIdentity"
},
"method": "GET",
"uri": "https://management.azure.com/@{body('Run_query_and_list_results')['value'][0]['resourceId']}/providers/Microsoft.Authorization/roleAssignments?api-version=2018-09-01-preview"
}
},
"HTTP_2": {
"runAfter": {
"For_each_2": [
"Succeeded"
]
},
"type": "Http",
"inputs": {
"authentication": {
"audience": "https://graph.windows.net/",
"type": "ManagedServiceIdentity"
},
"body": {
"includeDirectoryObjectReferences": true,
"objectIds": "@variables('simpleassignarray')",
"types": [
Updates to Notify playbook - notifies owners and contributors - includes mail enabled security groups - includes user or groups with otherMails property
2020-03-08 22:05:20 +03:00
"user",
"group"
New Azure Sentinel Playbook This playbook will notify all mail enabled users assigned RBAC on the Azure Resource via a ASC alert generated Sentinel Incident
2020-02-26 02:10:30 +03:00
]
},
"method": "POST",
"uri": "https://graph.windows.net/@{parameters('TenantID')}/getObjectsByObjectIds?api-version=1.6"
}
},
"Parse_JSON": {
"runAfter": {
"Run_query_and_list_results": [
"Succeeded"
]
},
"type": "ParseJson",
"inputs": {
"content": "@body('Run_query_and_list_results')?['value']",
"schema": {
"items": {
"properties": {
"AlertLink": {
"type": "string"
},
"AlertName": {
"type": "string"
},
"AlertSeverity": {
"type": "string"
},
"AlertType": {
"type": "string"
},
"ConfidenceLevel": {
"type": "string"
},
"ConfidenceScore": {},
"Description": {
"type": "string"
},
"DisplayName": {
"type": "string"
},
"EndTime": {
"type": "string"
},
"Entities": {
"type": "string"
},
"ExtendedLinks": {
"type": "string"
},
"ExtendedProperties": {
"type": "string"
},
"IsIncident": {
"type": "boolean"
},
"ProcessingEndTime": {
"type": "string"
},
"ProductComponentName": {
"type": "string"
},
"ProductName": {
"type": "string"
},
"ProviderName": {
"type": "string"
},
"RemediationSteps": {
"type": "string"
},
"ResourceId": {
"type": "string"
},
"SourceComputerId": {
"type": "string"
},
"SourceSystem": {
"type": "string"
},
"StartTime": {
"type": "string"
},
"SystemAlertId": {
"type": "string"
},
"TenantId": {
"type": "string"
},
"TimeGenerated": {
"type": "string"
},
"Type": {
"type": "string"
},
"VendorName": {
"type": "string"
},
"VendorOriginalId": {
"type": "string"
},
"WorkspaceResourceGroup": {
"type": "string"
},
"WorkspaceSubscriptionId": {
"type": "string"
},
"resourceprovider": {
"type": "string"
},
"resourcergname": {
"type": "string"
}
},
"required": [
"SystemAlertId",
"TimeGenerated",
"TenantId",
"DisplayName",
"AlertName",
"AlertSeverity",
"Description",
"ProviderName",
"VendorName",
"VendorOriginalId",
"ResourceId",
"SourceComputerId",
"AlertType",
"ConfidenceLevel",
"ConfidenceScore",
"IsIncident",
"StartTime",
"EndTime",
"ProcessingEndTime",
"RemediationSteps",
"ExtendedProperties",
"Entities",
"SourceSystem",
"WorkspaceSubscriptionId",
"WorkspaceResourceGroup",
"ExtendedLinks",
"ProductName",
"ProductComponentName",
"AlertLink",
"Type"
],
"type": "object"
},
"type": "array"
}
}
},
"Run_query_and_list_results": {
"runAfter": {},
"type": "ApiConnection",
"inputs": {
"body": "SecurityAlert\n| summarize arg_max(TimeGenerated, *) by SystemAlertId\n| where SystemAlertId in (\"@{items('For_each')}\")\n| where TimeGenerated >= ago (90d)",
"host": {
"connection": {
"name": "@parameters('$connections')['azuremonitorlogs']['connectionId']"
}
},
"method": "post",
"path": "/queryData",
"queries": {
"resourcegroups": "[parameters('AzureSentinelLogAnalyticsWorkspaceResourceGroupName')]",
"resourcename": "[parameters('AzureSentinelLogAnalyticsWorkspaceName')]",
"resourcetype": "Log Analytics Workspace",
"subscriptions": "[subscription().subscriptionId]",
"timerange": "Set in query"
}
}
},
"Send_an_email_(V2)": {
"runAfter": {
"For_each_3": [
"Succeeded"
]
},
"type": "ApiConnection",
"inputs": {
"body": {
"Body": "<p>SOC Analyst has found an issue that needs further investigation within the Azure resource.<br>\n<br>\nPlease read the following discovery report to take action: @{body('Parse_JSON')[0]?['AlertLink']}<br>\n<br>\nPlease contact your security team with Case: @{body('Alert_-_Get_incident')?['properties']?['CaseNumber']}</p>",
"Importance": "High",
"Subject": "Severity - @{body('Alert_-_Get_incident')?['properties']?['Severity']} - @{triggerBody()?['AlertDisplayName']}",
"To": "@variables('emailstring')"
},
"host": {
"connection": {
"name": "@parameters('$connections')['office365']['connectionId']"
}
},
"method": "post",
"path": "/v2/Mail"
}
}
},
"runAfter": {
"Initialize_variable_2": [
"Succeeded"
]
},
"type": "Foreach"
},
"Initialize_variable": {
"runAfter": {
"Alert_-_Get_incident": [
"Succeeded"
]
},
"type": "InitializeVariable",
"inputs": {
"variables": [
{
"name": "simpleassignarray",
"type": "array",
"value": []
}
]
}
},
"Initialize_variable_2": {
"runAfter": {
"Initialize_variable": [
"Succeeded"
]
},
"type": "InitializeVariable",
"inputs": {
"variables": [
{
"name": "emailstring",
"type": "string",
"value": "@{null}"
}
]
}
}
},
"outputs": {}
},
"parameters": {
"$connections": {
"value": {
"azuresentinel": {
"connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]",
"connectionName": "[variables('AzureSentinelConnectionName')]",
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
},
"azuremonitorlogs": {
"connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureMonitorLogsConnectionName'))]",
"connectionName": "[variables('AzureMonitorLogsConnectionName')]",
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuremonitorlogs')]"
},
"office365": {
"connectionId": "[resourceId('Microsoft.Web/connections', variables('office365ConnectionName'))]",
"connectionName": "office365",
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/office365')]"
}
}
}
}
}
}
]
}