Azure
/
Azure-Sentinel
зеркало из
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Merge pull request #2576 from IronNetCybersecurity/IronNet-IronDefense-Solution 

IronNet IronDefense Solution Initial Version
This commit is contained in:
v-jayakal 2021-07-26 10:59:28 -07:00 коммит произвёл GitHub
Родитель 833abd421d 180149dcaf
Коммит 13d2df0ebc
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: 4AEE18F83AFDEB23
33 изменённых файлов: 6065 добавлений и 1 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

3
.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json
Просмотреть файл

@ -123,5 +123,6 @@
"ZimperiumMtdAlerts",
"Zscaler",
"illusiveAttackManagementSystem",
"WindowsSecurityEvents"
"WindowsSecurityEvents",
"IronNetIronDefense"
]

25
Logos/IronNet.svg Normal file
Просмотреть файл

@ -0,0 +1,25 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- Generator: Adobe Illustrator 25.3.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->
<svg version="1.1" id="930cbf35-7d19-487c-90d9-d22eb6b0ed9d" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px"
viewBox="0 0 75 75" xml:space="preserve">
<g>
<rect x="41.9" y="47.2" transform="matrix(0.5 -0.866 0.866 0.5 -20.0165 62.121)" fill="#2A7DE1" width="3.7" height="2.5"/>
<path fill="#2A7DE1" d="M36.9,3.7l-9.6,5.5c-0.3,0.2-0.6,0.6-0.6,1v11.1c0,0.2,0.1,0.4,0.2,0.6c0.1,0.2,0.2,0.3,0.4,0.4l9.6,5.5
c0.3,0.2,0.8,0.2,1.1,0l9.6-5.5c0.3-0.2,0.6-0.6,0.6-1V10.2c0-0.4-0.2-0.8-0.6-1l-9.6-5.5C37.7,3.4,37.3,3.4,36.9,3.7 M45.2,10.6
c0.3,0.2,0.5,0.5,0.5,0.9v8.3c0,0.4-0.2,0.7-0.5,0.9L38,24.9c-0.3,0.2-0.7,0.2-1.1,0l-7.2-4.1c-0.2-0.1-0.3-0.2-0.4-0.4
c-0.1-0.2-0.1-0.3-0.1-0.5v-8.3c0-0.4,0.2-0.7,0.5-0.9L37,6.5c0.3-0.2,0.7-0.2,1.1,0L45.2,10.6z"/>
<rect x="42.5" y="24.7" transform="matrix(0.866 -0.5 0.5 0.866 -7.4356 25.4595)" fill="#2A7DE1" width="2.5" height="3.7"/>
<path fill="#2A7DE1" d="M49.5,25.4L39.9,31c-0.3,0.2-0.6,0.6-0.6,1V43c0,0.2,0.1,0.4,0.2,0.6c0.1,0.2,0.2,0.3,0.4,0.4l9.6,5.5
c0.3,0.2,0.8,0.2,1.1,0l9.6-5.5c0.3-0.2,0.6-0.6,0.6-1V32c0-0.4-0.2-0.8-0.6-1l-9.6-5.5C50.3,25.2,49.9,25.2,49.5,25.4 M57.8,32.4
c0.3,0.2,0.5,0.5,0.5,0.9v8.3c0,0.4-0.2,0.7-0.5,0.9l-7.2,4.1c-0.3,0.2-0.7,0.2-1.1,0l-7.2-4.1c-0.2-0.1-0.3-0.2-0.4-0.4
c-0.1-0.2-0.1-0.3-0.1-0.5v-8.3c0-0.4,0.2-0.7,0.5-0.9l7.2-4.1c0.3-0.2,0.7-0.2,1.1,0L57.8,32.4z"/>
<path fill="#2A7DE1" d="M36.9,47.2l-9.6,5.5c-0.3,0.2-0.6,0.6-0.6,1v11.1c0,0.4,0.2,0.8,0.6,1l9.6,5.5c0.3,0.2,0.8,0.2,1.1,0l9.6-5.5
c0.2-0.1,0.3-0.2,0.4-0.4c0.1-0.2,0.2-0.4,0.2-0.6V53.7c0-0.4-0.2-0.8-0.6-1l-9.6-5.5C37.7,47,37.3,47,36.9,47.2 M37,50.1
c0.3-0.2,0.7-0.2,1.1,0l7.2,4.1c0.3,0.2,0.5,0.5,0.5,0.9v8.3c0,0.2-0.1,0.4-0.1,0.5c-0.1,0.2-0.2,0.3-0.4,0.4L38,68.5
c-0.3,0.2-0.7,0.2-1.1,0l-7.2-4.1c-0.3-0.2-0.5-0.5-0.5-0.9v-8.3c0-0.4,0.2-0.7,0.5-0.9L37,50.1z"/>
<path fill="#EA0029" d="M24.4,25.4L14.8,31c-0.3,0.2-0.6,0.6-0.6,1V43c0,0.2,0.1,0.4,0.2,0.6c0.1,0.2,0.2,0.3,0.4,0.4l9.6,5.5
c0.3,0.2,0.8,0.2,1.1,0l9.6-5.5c0.3-0.2,0.6-0.6,0.6-1V32c0-0.4-0.2-0.8-0.6-1l-9.6-5.5C25.1,25.2,24.7,25.2,24.4,25.4 M32.6,32.4
c0.3,0.2,0.5,0.5,0.5,0.9v8.3c0,0.4-0.2,0.7-0.5,0.9l-7.2,4.1c-0.3,0.2-0.7,0.2-1.1,0l-7.2-4.1c-0.2-0.1-0.3-0.2-0.4-0.4
c-0.1-0.2-0.1-0.3-0.1-0.5v-8.3c0-0.4,0.2-0.7,0.5-0.9l7.2-4.1c0.3-0.2,0.7-0.2,1.1,0L32.6,32.4z"/>
</g>
</svg>
Режим "рядом"

После

Ширина:  |  Высота:  |  Размер: 2.4 KiB

61
Solutions/IronNet IronDefense/Analytic Rules/IronDefense_Detection_Query.yaml Normal file
Просмотреть файл

@ -0,0 +1,61 @@
id: 3cf46cb9-99d5-42ee-a43c-7bd88ea394a1
name: Create Incidents from IronDefense
description: |
'Creates incidents based on behavioral detections from IronDefense.'
severity: Medium
requiredDataConnectors:
- connectorId: IronNetIronDefense
dataTypes:
- CommonSecurityLog
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
relevantTechniques:
query: |
CommonSecurityLog
| where DeviceProduct == "IronDefense"
| summarize arg_max(TimeGenerated, *) by DeviceCustomString4, DeviceCustomString2
| extend Category = extract(@'cat=([^;]+)(\;|$)', 1, AdditionalExtensions)
| extend Subcategory = extract(@'subcat=([^;]+)(\;|$)', 1, AdditionalExtensions)
| extend AlertDescription = strcat(Category, ': ', Subcategory)
| extend Status = tostring(DeviceCustomString2)
| extend IronVueUrl = replace(@'\\', @'', tostring(DeviceCustomString3))
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: DestinationIP
- entityType: IP
fieldMappings:
- identifier: Address
columnName: SourceIP
- entityType: Host
fieldMappings:
- identifier: FullName
columnName: DestinationHostName
- entityType: Host
fieldMappings:
- identifier: FullName
columnName: SourceHostName
- entityType: URL
fieldMappings:
- identifier: Url
columnName: RequestURL
customDetails:
IronDefenseStatus: Status
AnalystRating: LogSeverity
AlertCreatedTime: TimeGenerated
IronVueUrl: IronVueUrl
IronDefenseAlertId: DeviceCustomString4
AnalystSeverity: DeviceCustomString1
eventGroupingSettings:
aggregationKind: AlertPerResult
alertDetailsOverride:
alertDisplayNameFormat: |
{{Category}}: {{Subcategory}} ({{DeviceCustomString4}})
alertDescriptionFormat: |
IronDefense detected suspicious activity on {{TimeGenerated}} and categorized it as "{{AlertDescription}}". View full details in IronVue: {{IronVueUrl}}
alertSeverityColumnName: LogSeverity
version: 1.0.0

172
Solutions/IronNet IronDefense/DataConnectors/IronNetIronDefense.json Normal file
Просмотреть файл

@ -0,0 +1,172 @@
{
"id": "IronNetIronDefense",
"title": "IronNet IronDefense",
"publisher": "IronNet",
"descriptionMarkdown": "The IronNet IronDefense connector enables ingest of IronDefense alerts, events, and IronDome notifications into Sentinel, enabling Sentinel to utilize IronDefense's behavioral analytics and the IronDome community to quickly identify threats in your enterprise network.",
"graphQueries": [
{
"metricName": "Total data received",
"legend": "IronNet",
"baseQuery": "CommonSecurityLog\n| where DeviceVendor == \"IronNet\""
}
],
"sampleQueries": [
{
"description": "10 most recent IronDefense alerts",
"query": "CommonSecurityLog \n| where DeviceVendor == \"IronNet\" and DeviceProduct == \"IronDefense\" and EventType == 1 | limit 10"
},
{
"description": "10 most recent IronDefense events",
"query": "CommonSecurityLog \n| where DeviceVendor == \"IronNet\" and DeviceProduct == \"IronDefense\" and EventType == 0 | limit 10"
},
{
"description": "10 most recent IronDome notifications",
"query": "CommonSecurityLog \n| where DeviceVendor == \"IronNet\" and DeviceProduct == \"IronDome\" | limit 10"
}
],
"dataTypes": [
{
"name": "CommonSecurityLog (IronNet)",
"lastDataReceivedQuery": "CommonSecurityLog\n| where DeviceVendor == \"IronNet\"\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
}
],
"connectivityCriterias": [
{
"type": "IsConnectedQuery",
"value": [
"CommonSecurityLog\n| where DeviceVendor == \"IronNet\"\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(30d)"
]
}
],
"availability": {
"status": 1,
"isPreview": true
},
"permissions": {
"resourceProvider": [
{
"provider": "Microsoft.OperationalInsights/workspaces",
"permissionsDisplayText": "read and write permissions are required.",
"providerDisplayName": "Workspace",
"scope": "Workspace",
"requiredPermissions": {
"read": true,
"write": true,
"delete": true
}
},
{
"provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
"permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
"providerDisplayName": "Keys",
"scope": "Workspace",
"requiredPermissions": {
"action": true
}
}
]
},
"instructionSteps": [
{
"title": "1. Linux Syslog agent configuration",
"description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Azure Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace",
"innerSteps": [
{
"title": "1.1 Select or create a Linux machine",
"description": "Select or create a Linux machine that Azure Sentinel will use as the proxy between your security solution and Azure Sentinel this machine can be on your on-prem environment, Azure or other clouds."
},
{
"title": "1.2 Install the CEF collector on the Linux machine",
"description": "Install the Microsoft Monitoring Agent on your Linux machine and configure the machine to listen on the necessary port and forward messages to your Azure Sentinel workspace. The CEF collector collects CEF messages on port 514 TCP.\n\n> 1. Make sure that you have Python on your machine using the following command: python -version.\n\n> 2. You must have elevated permissions (sudo) on your machine.",
"instructions": [
{
"parameters": {
"fillWith": [
"WorkspaceId",
"PrimaryKey"
],
"label": "Run the following command to install and apply the CEF collector:",
"value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py&&sudo python cef_installer.py {0} {1}"
},
"type": "CopyableLabel"
}
]
}
]
},
{
"title": "2. Forward Common Event Format (CEF) logs to Syslog agent",
"description": "Configure the IronNet Data Collector to send alerts, events, and IronDome notifications in CEF format to the proxy machine. Make sure you to send the logs to port 514 TCP on the machine's IP address.",
"innerSteps": [
{
"title": "2.1 Deploy the IronNet Data Collector VM",
"description": "Deploy the IronNet Data Collector VM using the image provided by your IronNet representative."
},
{
"title": "2.2 Configure the IronAPI connector using the Data Collector wizard.",
"description": "Ssh into the Data Collector VM as the config user and use the Data Collector configuration wizard to configure the IronAPI connector to receive notifications from IronDefense and forward them to your Azure Sentinel workspace. You will need:\n\n> 1. IronAPI credentials.\n\n> 2. IronDefense hostname.\n\n> 3. The public IP of the linux machine running the CEF collector.",
"instructions": [
{
"parameters": {
"label": "Run the following command to launch the Data Collector configuration wizard:",
"value": "wizard"
},
"type": "CopyableLabel"
}
]
},
{
"title": "2.2 Verify IronAPI connector configuration",
"description": "Verify the IronAPI connector has been configured properly and is running normally.",
"instructions": [
{
"parameters": {
"label": "Run the following command to view the logs in the IronAPI connector. If no errors occur after 5 minutes, the connector is running normally.",
"value": "sudo journalctl -f CONTAINER_NAME=ironapi-notifications-collector"
},
"type": "CopyableLabel"
}
]
}
]
},
{
"title": "3. Validate connection",
"description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\n>It may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n> 1. Make sure that you have Python on your machine using the following command: python -version\n\n>2. You must have elevated permissions (sudo) on your machine",
"instructions": [
{
"parameters": {
"fillWith": [
"WorkspaceId"
],
"label": "Run the following command to validate your connectivity:",
"value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py&&sudo python cef_troubleshoot.py {0}"
},
"type": "CopyableLabel"
}
]
},
{
"title": "4. Secure your machine ",
"description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)"
}
],
"metadata": {
"id": "36f65971-b4a5-41ac-8f80-874a03121051",
"version": "1.0.0",
"kind": "dataConnector",
"source": {
"kind": "solution",
"name": "IronDefense"
},
"author": {
"name": "IronNet"
},
"support": {
"tier": "developer",
"name": "IronNet",
"email": "sre@ironnet.com",
"link": "https://www.ironnet.com/support"
}
}
}

Двоичные данные
Solutions/IronNet IronDefense/Playbooks/IronNet_UpdateIronDefenseAlerts/AnalyticRuleBlack.png Normal file
Просмотреть файл

Двоичный файл не отображается.
Режим "рядом"

После

Ширина:  |  Высота:  |  Размер: 156 KiB

Двоичные данные
Solutions/IronNet IronDefense/Playbooks/IronNet_UpdateIronDefenseAlerts/AnalyticRuleWhite.png Normal file
Просмотреть файл

Двоичный файл не отображается.
Режим "рядом"

После

Ширина:  |  Высота:  |  Размер: 131 KiB

Двоичные данные
Solutions/IronNet IronDefense/Playbooks/IronNet_UpdateIronDefenseAlerts/UpdateIronDefenseAlertsBlack.png Normal file
Просмотреть файл

Двоичный файл не отображается.
Режим "рядом"

После

Ширина:  |  Высота:  |  Размер: 20 KiB

Двоичные данные
Solutions/IronNet IronDefense/Playbooks/IronNet_UpdateIronDefenseAlerts/UpdateIronDefenseAlertsWhite.png Normal file
Просмотреть файл

Двоичный файл не отображается.
Режим "рядом"

После

Ширина:  |  Высота:  |  Размер: 30 KiB

1497
Solutions/IronNet IronDefense/Playbooks/IronNet_UpdateIronDefenseAlerts/azuredeploy.json Normal file
Просмотреть файл

Разница между файлами не показана из-за своего большого размера Загрузить разницу

36
Solutions/IronNet IronDefense/Playbooks/IronNet_UpdateIronDefenseAlerts/readme.md Normal file
Просмотреть файл

@ -0,0 +1,36 @@
# IronNet_UpdateIronDefenseAlerts
author: IronNet
This playbook is used to keep IronDefense and Azure Sentinel in sync by
receiving Sentinel incident updates to update the corresponding IronDefense
alert workflow status and analyst rating through IronAPI. The playbook
should be set to run when a new alert is generated by the "Create Incidents from
IronDefense" analytic rule.
## Prerequisites
1. Create an IronVue user with the following permissions:
* Access IronAPI
* View Alert
* Edit Alert
* Manage Threat Intelligence Rules
2. Configure the IronNet IronDefense data connector.
3. Create an analytic rule using the "Create Incidents from IronDefense" rule
template.
## Deployment Instructions
1. Click the "Deploy to Azure" button to open the ARM template wizard to deploy
this playbook.<br>
[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FIronNet%20IronDefense%2FPlaybooks%2FIronNet_UpdateIronDefenseAlerts%2Fazuredeploy.json) [![Deploy to Azure](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FIronNet%20IronDefense%2FPlaybooks%2FIronNet_UpdateIronDefenseAlerts%2Fazuredeploy.json)
2. Enter template parameters. Use the IronVue user credentials for IronAPI.
## Post-deployment Instructions
1. Edit the "Create Incidents from IronDefense" analytic rule in your Azure
Sentinel workspace.
2. Click the "Automated Response" tab and select this playbook to run when new
alerts are generated.
## Playbook Execution
1. The Playbook execution begins at configured intervals to check if the Sentinel
Incidents has been updated
2. Using the IronAPI for an updated Sentinel Incident, the status along with its
classification will be updated to the corresponding IronDefense Alert

Двоичные данные
Solutions/IronNet IronDefense/Playbooks/IronNet_UpdateSentinelIncidents/AnalyticRuleBlack.png Normal file
Просмотреть файл

Двоичный файл не отображается.
Режим "рядом"

После

Ширина:  |  Высота:  |  Размер: 156 KiB

Двоичные данные
Solutions/IronNet IronDefense/Playbooks/IronNet_UpdateSentinelIncidents/AnalyticRuleWhite.png Normal file
Просмотреть файл

Двоичный файл не отображается.
Режим "рядом"

После

Ширина:  |  Высота:  |  Размер: 131 KiB

Двоичные данные
Solutions/IronNet IronDefense/Playbooks/IronNet_UpdateSentinelIncidents/IncidentUpdatedBlack.png Normal file
Просмотреть файл

Двоичный файл не отображается.
Режим "рядом"

После

Ширина:  |  Высота:  |  Размер: 148 KiB

Двоичные данные
Solutions/IronNet IronDefense/Playbooks/IronNet_UpdateSentinelIncidents/IncidentUpdatedWhite.png Normal file
Просмотреть файл

Двоичный файл не отображается.
Режим "рядом"

После

Ширина:  |  Высота:  |  Размер: 156 KiB

Двоичные данные
Solutions/IronNet IronDefense/Playbooks/IronNet_UpdateSentinelIncidents/SentinelIncidentsBlack.png Normal file
Просмотреть файл

Двоичный файл не отображается.
Режим "рядом"

После

Ширина:  |  Высота:  |  Размер: 90 KiB

Двоичные данные
Solutions/IronNet IronDefense/Playbooks/IronNet_UpdateSentinelIncidents/SentinelIncidentsWhite.png Normal file
Просмотреть файл

Двоичный файл не отображается.
Режим "рядом"

После

Ширина:  |  Высота:  |  Размер: 80 KiB

Двоичные данные
Solutions/IronNet IronDefense/Playbooks/IronNet_UpdateSentinelIncidents/UpdateSentinelIncidentCommentsBlack.png Normal file
Просмотреть файл

Двоичный файл не отображается.
Режим "рядом"

После

Ширина:  |  Высота:  |  Размер: 69 KiB

Двоичные данные
Solutions/IronNet IronDefense/Playbooks/IronNet_UpdateSentinelIncidents/UpdateSentinelIncidentCommentsWhite.png Normal file
Просмотреть файл

Двоичный файл не отображается.
Режим "рядом"

После

Ширина:  |  Высота:  |  Размер: 77 KiB

Двоичные данные
Solutions/IronNet IronDefense/Playbooks/IronNet_UpdateSentinelIncidents/UpdateSentinelIncidentsBlack.png Normal file
Просмотреть файл

Двоичный файл не отображается.
Режим "рядом"

После

Ширина:  |  Высота:  |  Размер: 17 KiB

Двоичные данные
Solutions/IronNet IronDefense/Playbooks/IronNet_UpdateSentinelIncidents/UpdateSentinelIncidentsWhite.png Normal file
Просмотреть файл

Двоичный файл не отображается.
Режим "рядом"

После

Ширина:  |  Высота:  |  Размер: 27 KiB

1295
Solutions/IronNet IronDefense/Playbooks/IronNet_UpdateSentinelIncidents/azuredeploy.json Normal file
Просмотреть файл

Разница между файлами не показана из-за своего большого размера Загрузить разницу

34
Solutions/IronNet IronDefense/Playbooks/IronNet_UpdateSentinelIncidents/readme.md Normal file
Просмотреть файл

@ -0,0 +1,34 @@
# IronNet_UpdateSentinelIncidents
author: IronNet
This playbook is used to keep IronDefense and Azure Sentinel in sync by
triggering on any new IronDefense alert notifications that is added to a
Sentinel incident and updating the incident's status and classification based on
the IronDefense alert.
## Prerequisites
1. Configure the IronNet IronDefense data connector.
2. Create an analytic rule using the "Create Incidents from IronDefense" rule
template.
## Deployment Instructions
1. Click the "Deploy to Azure" button to open the ARM template wizard to deploy
this playbook.<br>
[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FIronNet%20IronDefense%2FPlaybooks%2FIronNet_UpdateSentinelIncidents%2Fazuredeploy.json) [![Deploy to Azure](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FIronNet%20IronDefense%2FPlaybooks%2FIronNet_UpdateSentinelIncidents%2Fazuredeploy.json)
2. Enter template parameters. Use the IronVue user credentials for IronAPI.
## Playbook Execution
1. The Playbook execution begins with an Alert triggered due to the IronDefense
Alert activity
2. This Alert contains the actions taken by the IronDefense Alert
3. These actions will have the information about the status, classification and
severity of the Irondefense Alert
4. These details will be picked from the IronDefense and update to its corresponding
Sentinel Incidents
5. The Alerts from IronDefense will be the Events associated with the Sentinel Incidents
6. The Status, Classification and Severity of the Irondefense Alert will be updated as
the Sentinel Incident's status, classification and severity respectively
7. The Sentinel Incident's "custom details" will be consisting of IronDefense Analyst rating,
AlertCreatedTime and IronDefenseAlertId fields
8. The Sentinel Incident's comments will be updated with the comments raised by users for IronDome Notifications

Двоичные данные
Solutions/IronNet IronDefense/Playbooks/IronNet_Validate_IronNet_API/Validate_IronNet_APIBlack.png Normal file
Просмотреть файл

Двоичный файл не отображается.
Режим "рядом"

После

Ширина:  |  Высота:  |  Размер: 9.7 KiB

Двоичные данные
Solutions/IronNet IronDefense/Playbooks/IronNet_Validate_IronNet_API/Validate_IronNet_APIWhite.png Normal file
Просмотреть файл

Двоичный файл не отображается.
Режим "рядом"

После

Ширина:  |  Высота:  |  Размер: 14 KiB

684
Solutions/IronNet IronDefense/Playbooks/IronNet_Validate_IronNet_API/azuredeploy.json Normal file
Просмотреть файл

@ -0,0 +1,684 @@
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"metadata": {
"comments": "Enrich IronNet Alerts based on the corresponding Sentinel Incident updates via IronNet Endpoints",
"author": "IronNet"
},
"parameters": {
"IronApiUsername": {
"type": "String",
"metadata": {
"description": "Username used to authenticate to IronAPI"
}
},
"IronApiPassword": {
"type": "SecureString",
"metadata": {
"description": "Password used to authenticate to IronAPI"
}
},
"IronDefenseUrl": {
"type": "String",
"metadata": {
"description": "IronNet URL used to authenticate to IronAPI"
}
},
"Playbook Name": {
"type": "String",
"metadata": {
"description": "Playbook name to test the IronNet API's"
}
}
},
"resources": [
{
"type": "Microsoft.Logic/workflows",
"apiVersion": "2017-07-01",
"name": "[parameters('Playbook Name')]",
"location": "eastus",
"properties": {
"state": "Disabled",
"definition": {
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"IronNetUrl": {
"defaultValue": "[parameters('IronDefenseUrl')]",
"type": "SecureString"
},
"Password": {
"defaultValue": "[parameters('IronApiPassword')]",
"type": "SecureString"
},
"Username": {
"defaultValue": "[parameters('IronApiUsername')]",
"type": "SecureString"
}
},
"triggers": {
"IronNet_Login": {
"recurrence": {
"frequency": "Month",
"interval": 1
},
"correlation": {
"clientTrackingId": "login"
},
"type": "Http",
"inputs": {
"authentication": {
"password": "@parameters('Password')",
"type": "Basic",
"username": "@parameters('Username')"
},
"body": {},
"headers": {
"Content-Type": "application/json"
},
"method": "POST",
"uri": "@{parameters('IronNetUrl')}/IronApi/Login"
},
"conditions": [],
"runtimeConfiguration": {
"secureData": {
"properties": [
"inputs"
]
}
}
}
},
"actions": {
"Fetch_token": {
"runAfter": {
"Initialize_EventId": [
"Succeeded"
]
},
"type": "ParseJson",
"inputs": {
"content": "@triggerBody()",
"schema": {
"properties": {
"token": {
"type": "string"
}
},
"type": "object"
}
}
},
"Initialize_AlertId": {
"runAfter": {
"Initialize_EndpointConnectivity": [
"Succeeded"
]
},
"type": "InitializeVariable",
"inputs": {
"variables": [
{
"name": "AlertId",
"type": "string",
"value": "816546532a7d4f0a98f905394ccd3680"
}
]
}
},
"Initialize_EndpointConnectivity": {
"runAfter": {},
"type": "InitializeVariable",
"inputs": {
"variables": [
{
"name": "EndpointConnectivity",
"type": "boolean",
"value": false
}
]
}
},
"Initialize_EventId": {
"runAfter": {
"Initialize_AlertId": [
"Succeeded"
]
},
"type": "InitializeVariable",
"inputs": {
"variables": [
{
"name": "EventId",
"type": "string",
"value": "65c121960e7e4304a55507e098bfac73"
}
]
}
},
"Ironnet_API_Connectivity": {
"actions": {
"Display_Endpoint_Responses": {
"runAfter": {},
"type": "Compose",
"inputs": "GetAlert Response:\n@{body('GetAlerts_API_call')}\nRateAlert Response:\n@{body('RateAlert_API_call')}\nCommentOnAlert Response:\n@{body('CommentOnAlert_API_call')}\nSetAlertStatus Response:\n@{body('SetAlertStatus_API_call')}\nGetEvents Response:\n@{body('GetEvents_API_call')}\nGetEvent Response:\n@{body('GetEvent_API_call')}\nGetAlertIronDomeInformation Response:\n@{body('GetAlertIronDomeInformation_API_call')}\nReportObservedBadActivity Response:\n@{body('ReportObservedBadActivity_API_call')}\n"
}
},
"runAfter": {
"Testing_Ironnet_API_Connectivity": [
"Succeeded"
]
},
"else": {
"actions": {
"Error_Message": {
"runAfter": {},
"type": "Compose",
"inputs": "Error in connectivity. Please try again..."
}
}
},
"expression": {
"and": [
{
"equals": [
"@variables('EndpointConnectivity')",
true
]
}
]
},
"type": "If"
},
"Testing_Ironnet_API_Connectivity": {
"actions": {
"CommentOnAlert_API_call": {
"runAfter": {
"GetAlerts_API_call": [
"Succeeded"
]
},
"type": "Http",
"inputs": {
"body": {
"alert_id": "@variables('AlertId')",
"comment": "commenting on alert for ironapi postman test",
"share_comment_with_irondome": true
},
"headers": {
"Authorization": "Bearer @{body('Fetch_token')?['token']}",
"Content-Type": "application/json"
},
"method": "POST",
"uri": "@{parameters('IronNetUrl')}/IronApi/CommentOnAlert"
}
},
"GetAlertIronDomeInformation_API_call": {
"runAfter": {
"Ironnet_Login_Connectivity_Succeeded": [
"Succeeded"
]
},
"type": "Http",
"inputs": {
"body": {
"alert_id": "@variables('AlertId')"
},
"headers": {
"Authorization": "Bearer @{body('Fetch_token')?['token']}",
"Content-Type": "application/json"
},
"method": "POST",
"uri": "@{parameters('IronNetUrl')}/IronApi/GetAlertIronDomeInformation"
}
},
"GetAlerts_API_call": {
"runAfter": {
"Ironnet_Login_Connectivity_Succeeded": [
"Succeeded"
]
},
"type": "Http",
"inputs": {
"body": {},
"headers": {
"Authorization": "Bearer @{body('Fetch_token')?['token']}",
"Content-Type": "application/json"
},
"method": "POST",
"uri": "@{parameters('IronNetUrl')}/IronApi/GetAlerts"
}
},
"GetEvents_API_call": {
"runAfter": {
"Ironnet_Login_Connectivity_Succeeded": [
"Succeeded"
]
},
"type": "Http",
"inputs": {
"body": {
"alert_id": "816546532a7d4f0a98f905394ccd3680"
},
"headers": {
"Authorization": "Bearer @{body('Fetch_token')?['token']}",
"Content-Type": "application/json"
},
"method": "POST",
"uri": "@{parameters('IronNetUrl')}/IronApi/GetEvents"
}
},
"Ironnet_Login_Connectivity_Succeeded": {
"runAfter": {},
"type": "SetVariable",
"inputs": {
"name": "EndpointConnectivity",
"value": true
}
},
"RateAlert_API_call": {
"runAfter": {
"GetAlerts_API_call": [
"Succeeded"
]
},
"type": "Http",
"inputs": {
"body": {
"alert_id": "@variables('AlertId')",
"analyst_expectation": "EXP_UNEXPECTED",
"analyst_severity": "SEVERITY_MALICIOUS",
"comment": "IronAPI Postman Test Comment",
"share_comment_with_irondome": true
},
"headers": {
"Authorization": "Bearer @{body('Fetch_token')?['token']}",
"Content-Type": "application/json"
},
"method": "POST",
"uri": "@{parameters('IronNetUrl')}/IronApi/RateAlert"
}
},
"ReportObservedBadActivity_API_call": {
"runAfter": {
"Ironnet_Login_Connectivity_Succeeded": [
"Succeeded"
]
},
"type": "Http",
"inputs": {
"body": {
"activity_end_time": "2021-01-15T14:05:00.000Z",
"activity_start_time": "2021-01-15T14:05:00.000Z",
"description": "Some thing bad happend with computer?",
"domain": "some.computer2.com",
"ip": "173.17.0.120",
"name": "Bad Thing with Computers @{utcNow()}"
},
"headers": {
"Authorization": "Bearer @{body('Fetch_token')?['token']}",
"Content-Type": "application/json"
},
"method": "POST",
"uri": "@{parameters('IronNetUrl')}/IronApi/ReportObservedBadActivity"
}
},
"SetAlertStatus_API_call": {
"runAfter": {
"GetAlerts_API_call": [
"Succeeded"
]
},
"type": "Http",
"inputs": {
"body": {
"alert_id": "@variables('AlertId')",
"comment": "updating status for ironapi postman test",
"share_comment_with_irondome": true,
"status": "STATUS_AWAITING_REVIEW"
},
"headers": {
"Authorization": "Bearer @{body('Fetch_token')?['token']} ",
"Content-Type": "application/json"
},
"method": "POST",
"uri": "@{parameters('IronNetUrl')}/IronApi/SetAlertStatus"
}
},
"Testing_CommentOnAlert_API_Connectivity": {
"actions": {
"CommentOnAlert_Connectivity_Succeeded": {
"runAfter": {},
"type": "SetVariable",
"inputs": {
"name": "EndpointConnectivity",
"value": true
}
}
},
"runAfter": {
"CommentOnAlert_API_call": [
"Succeeded"
]
},
"else": {
"actions": {
"CommentOnAlert_Connectivity_Failed": {
"runAfter": {},
"type": "SetVariable",
"inputs": {
"name": "EndpointConnectivity",
"value": false
}
}
}
},
"expression": {
"and": [
{
"equals": [
"",
200
]
}
]
},
"type": "If"
},
"Testing_GetAlertIronDomeInformation_API_Connectivity": {
"actions": {
"GetAlertIronDomeInformation_Connectivity_Succeeded": {
"runAfter": {},
"type": "SetVariable",
"inputs": {
"name": "EndpointConnectivity",
"value": true
}
}
},
"runAfter": {
"GetAlertIronDomeInformation_API_call": [
"Succeeded"
]
},
"else": {
"actions": {
"GetAlertIronDomeInformation_Connectivity_Failed": {
"runAfter": {},
"type": "SetVariable",
"inputs": {
"name": "EndpointConnectivity",
"value": false
}
}
}
},
"expression": {
"and": [
{
"equals": [
"@outputs('GetAlertIronDomeInformation_API_call')['statusCode']",
200
]
}
]
},
"type": "If"
},
"Testing_GetEvents_API_Connectivity": {
"actions": {
"GetEvent_API_call": {
"runAfter": {
"GetEvents_Connectivity_Succeeded": [
"Succeeded"
]
},
"type": "Http",
"inputs": {
"body": {
"event_id": "@variables('EventId')"
},
"headers": {
"Authorization": "Bearer @{body('Fetch_token')?['token']}",
"Content-Type": "application/json"
},
"method": "POST",
"uri": "@{parameters('IronNetUrl')}/IronApi/GetEvent"
}
},
"GetEvents_Connectivity_Succeeded": {
"runAfter": {},
"type": "SetVariable",
"inputs": {
"name": "EndpointConnectivity",
"value": true
}
},
"Testing_GetEvent_API_Connectivity": {
"actions": {
"GetEvent_Connectivity_Succeeded": {
"runAfter": {},
"type": "SetVariable",
"inputs": {
"name": "EndpointConnectivity",
"value": true
}
}
},
"runAfter": {
"GetEvent_API_call": [
"Succeeded"
]
},
"else": {
"actions": {
"GetEvent_Connectivity_Failed": {
"runAfter": {},
"type": "SetVariable",
"inputs": {
"name": "EndpointConnectivity",
"value": false
}
}
}
},
"expression": {
"and": [
{
"equals": [
"@outputs('GetEvent_API_call')['statusCode']",
200
]
}
]
},
"type": "If"
}
},
"runAfter": {
"GetEvents_API_call": [
"Succeeded"
]
},
"else": {
"actions": {
"GetEvents_Connectivity_Failed": {
"runAfter": {},
"type": "SetVariable",
"inputs": {
"name": "EndpointConnectivity",
"value": false
}
}
}
},
"expression": {
"and": [
{
"equals": [
"@outputs('GetEvents_API_call')['statusCode']",
200
]
}
]
},
"type": "If"
},
"Testing_RateAlert_API_Connectivity": {
"actions": {
"RateAlert_Connectivity_Succeeded": {
"runAfter": {},
"type": "SetVariable",
"inputs": {
"name": "EndpointConnectivity",
"value": true
}
}
},
"runAfter": {
"RateAlert_API_call": [
"Succeeded"
]
},
"else": {
"actions": {
"RateAlert_Connectivity_Failed": {
"runAfter": {},
"type": "SetVariable",
"inputs": {
"name": "EndpointConnectivity",
"value": false
}
}
}
},
"expression": {
"and": [
{
"equals": [
"@outputs('RateAlert_API_call')['statusCode']",
200
]
}
]
},
"type": "If"
},
"Testing_ReportObservedBadActivity_API_Connectivity": {
"actions": {
"ReportObservedBadActivity_Connectivity_Succeeded": {
"runAfter": {},
"type": "SetVariable",
"inputs": {
"name": "EndpointConnectivity",
"value": true
}
}
},
"runAfter": {
"ReportObservedBadActivity_API_call": [
"Succeeded"
]
},
"else": {
"actions": {
"ReportObservedBadActivity_Connectivity_Failed": {
"runAfter": {},
"type": "SetVariable",
"inputs": {
"name": "EndpointConnectivity",
"value": false
}
}
}
},
"expression": {
"and": [
{
"equals": [
"@outputs('ReportObservedBadActivity_API_call')['statusCode']",
200
]
}
]
},
"type": "If"
},
"Testing_SetAlertStatus_API_Connectivity": {
"actions": {
"SetAlertStatus_Connectivity_Succeeded": {
"runAfter": {},
"type": "SetVariable",
"inputs": {
"name": "EndpointConnectivity",
"value": true
}
}
},
"runAfter": {
"SetAlertStatus_API_call": [
"Succeeded"
]
},
"else": {
"actions": {
"SetAlertStatus_Connectivity_Failed": {
"runAfter": {},
"type": "SetVariable",
"inputs": {
"name": "EndpointConnectivity",
"value": false
}
}
}
},
"expression": {
"and": [
{
"equals": [
"@outputs('SetAlertStatus_API_call')['statusCode']",
200
]
}
]
},
"type": "If"
}
},
"runAfter": {
"Fetch_token": [
"Succeeded"
]
},
"else": {
"actions": {
"GetAlerts_Connectivity_Failed": {
"runAfter": {},
"type": "SetVariable",
"inputs": {
"name": "EndpointConnectivity",
"value": false
}
}
}
},
"expression": {
"and": [
{
"equals": [
"@triggerOutputs()['statusCode']",
200
]
}
]
},
"type": "If"
}
},
"outputs": {}
},
"parameters": {}
}
}
]
}

16
Solutions/IronNet IronDefense/Playbooks/IronNet_Validate_IronNet_API/readme.md Normal file
Просмотреть файл

@ -0,0 +1,16 @@
# IronNet_ValidateIronAPI
author: IronNet
This playbook is used for validating IronAPI Endpoints.
## Deployment Instructions
1. Click the "Deploy to Azure" button to open the ARM template wizard to deploy
this playbook.<br>
[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FIronNet%20IronDefense%2FPlaybooks%2FIronNet_UpdateSentinelIncidents%2Fazuredeploy.json) [![Deploy to Azure](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FIronNet%20IronDefense%2FPlaybooks%2FIronNet_UpdateSentinelIncidents%2Fazuredeploy.json)
2. Enter template parameters. Use the IronVue user credentials for IronAPI.
## Playbook Execution
1. The Playbook execution begins with an API call to IronDefense
Alert.
2. This workflow validates for 8 IronAPI endpoints inorder to verify that the
API is stable.

25
Solutions/IronNet IronDefense/Workbooks/Images/Logos/IronNet.svg Normal file
Просмотреть файл

@ -0,0 +1,25 @@
<?xml version="1.0" encoding="utf-8"?>
<!-- Generator: Adobe Illustrator 25.3.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->
<svg version="1.1" id="930cbf35-7d19-487c-90d9-d22eb6b0ed9d" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px"
viewBox="0 0 75 75" xml:space="preserve">
<g>
<rect x="41.9" y="47.2" transform="matrix(0.5 -0.866 0.866 0.5 -20.0165 62.121)" fill="#2A7DE1" width="3.7" height="2.5"/>
<path fill="#2A7DE1" d="M36.9,3.7l-9.6,5.5c-0.3,0.2-0.6,0.6-0.6,1v11.1c0,0.2,0.1,0.4,0.2,0.6c0.1,0.2,0.2,0.3,0.4,0.4l9.6,5.5
c0.3,0.2,0.8,0.2,1.1,0l9.6-5.5c0.3-0.2,0.6-0.6,0.6-1V10.2c0-0.4-0.2-0.8-0.6-1l-9.6-5.5C37.7,3.4,37.3,3.4,36.9,3.7 M45.2,10.6
c0.3,0.2,0.5,0.5,0.5,0.9v8.3c0,0.4-0.2,0.7-0.5,0.9L38,24.9c-0.3,0.2-0.7,0.2-1.1,0l-7.2-4.1c-0.2-0.1-0.3-0.2-0.4-0.4
c-0.1-0.2-0.1-0.3-0.1-0.5v-8.3c0-0.4,0.2-0.7,0.5-0.9L37,6.5c0.3-0.2,0.7-0.2,1.1,0L45.2,10.6z"/>
<rect x="42.5" y="24.7" transform="matrix(0.866 -0.5 0.5 0.866 -7.4356 25.4595)" fill="#2A7DE1" width="2.5" height="3.7"/>
<path fill="#2A7DE1" d="M49.5,25.4L39.9,31c-0.3,0.2-0.6,0.6-0.6,1V43c0,0.2,0.1,0.4,0.2,0.6c0.1,0.2,0.2,0.3,0.4,0.4l9.6,5.5
c0.3,0.2,0.8,0.2,1.1,0l9.6-5.5c0.3-0.2,0.6-0.6,0.6-1V32c0-0.4-0.2-0.8-0.6-1l-9.6-5.5C50.3,25.2,49.9,25.2,49.5,25.4 M57.8,32.4
c0.3,0.2,0.5,0.5,0.5,0.9v8.3c0,0.4-0.2,0.7-0.5,0.9l-7.2,4.1c-0.3,0.2-0.7,0.2-1.1,0l-7.2-4.1c-0.2-0.1-0.3-0.2-0.4-0.4
c-0.1-0.2-0.1-0.3-0.1-0.5v-8.3c0-0.4,0.2-0.7,0.5-0.9l7.2-4.1c0.3-0.2,0.7-0.2,1.1,0L57.8,32.4z"/>
<path fill="#2A7DE1" d="M36.9,47.2l-9.6,5.5c-0.3,0.2-0.6,0.6-0.6,1v11.1c0,0.4,0.2,0.8,0.6,1l9.6,5.5c0.3,0.2,0.8,0.2,1.1,0l9.6-5.5
c0.2-0.1,0.3-0.2,0.4-0.4c0.1-0.2,0.2-0.4,0.2-0.6V53.7c0-0.4-0.2-0.8-0.6-1l-9.6-5.5C37.7,47,37.3,47,36.9,47.2 M37,50.1
c0.3-0.2,0.7-0.2,1.1,0l7.2,4.1c0.3,0.2,0.5,0.5,0.5,0.9v8.3c0,0.2-0.1,0.4-0.1,0.5c-0.1,0.2-0.2,0.3-0.4,0.4L38,68.5
c-0.3,0.2-0.7,0.2-1.1,0l-7.2-4.1c-0.3-0.2-0.5-0.5-0.5-0.9v-8.3c0-0.4,0.2-0.7,0.5-0.9L37,50.1z"/>
<path fill="#EA0029" d="M24.4,25.4L14.8,31c-0.3,0.2-0.6,0.6-0.6,1V43c0,0.2,0.1,0.4,0.2,0.6c0.1,0.2,0.2,0.3,0.4,0.4l9.6,5.5
c0.3,0.2,0.8,0.2,1.1,0l9.6-5.5c0.3-0.2,0.6-0.6,0.6-1V32c0-0.4-0.2-0.8-0.6-1l-9.6-5.5C25.1,25.2,24.7,25.2,24.4,25.4 M32.6,32.4
c0.3,0.2,0.5,0.5,0.5,0.9v8.3c0,0.4-0.2,0.7-0.5,0.9l-7.2,4.1c-0.3,0.2-0.7,0.2-1.1,0l-7.2-4.1c-0.2-0.1-0.3-0.2-0.4-0.4
c-0.1-0.2-0.1-0.3-0.1-0.5v-8.3c0-0.4,0.2-0.7,0.5-0.9l7.2-4.1c0.3-0.2,0.7-0.2,1.1,0L32.6,32.4z"/>
</g>
</svg>
Режим "рядом"

После

Ширина:  |  Высота:  |  Размер: 2.4 KiB

Двоичные данные
Solutions/IronNet IronDefense/Workbooks/Images/Preview/IronDefenseAlertsBlack.png Normal file
Просмотреть файл

Двоичный файл не отображается.
Режим "рядом"

После

Ширина:  |  Высота:  |  Размер: 79 KiB

Двоичные данные
Solutions/IronNet IronDefense/Workbooks/Images/Preview/IronDefenseAlertsWhite.png Normal file
Просмотреть файл

Двоичный файл не отображается.
Режим "рядом"

После

Ширина:  |  Высота:  |  Размер: 23 KiB

Двоичные данные
Solutions/IronNet IronDefense/Workbooks/Images/Preview/IronDefenseDashboardBlack.png Normal file
Просмотреть файл

Двоичный файл не отображается.
Режим "рядом"

После

Ширина:  |  Высота:  |  Размер: 96 KiB

Двоичные данные
Solutions/IronNet IronDefense/Workbooks/Images/Preview/IronDefenseDashboardWhite.png Normal file
Просмотреть файл

Двоичный файл не отображается.
Режим "рядом"

После

Ширина:  |  Высота:  |  Размер: 68 KiB

1114
Solutions/IronNet IronDefense/Workbooks/IronDefenseAlertDashboard.json Normal file
Просмотреть файл

Разница между файлами не показана из-за своего большого размера Загрузить разницу

1104
Solutions/IronNet IronDefense/Workbooks/IronDefenseAlertDetails.json Normal file
Просмотреть файл

Разница между файлами не показана из-за своего большого размера Загрузить разницу