Readme fixes - imgs
This commit is contained in:
Родитель
72dd12dfa2
Коммит
25d054fe44
|
@ -1,4 +1,4 @@
|
|||
# AutoConnect-ASCSubscriptions
|
||||
# Identity Protection - Email Response
|
||||
author: Lior Tamir
|
||||
|
||||
This playbook uses Azure Identity Protection features in order to responde to risky users.
|
||||
|
@ -7,7 +7,7 @@ When a new Azure Sentinel alert is created, the playbook iterates over the ident
|
|||
For each identity, playbook will send to the SOC email address (which is configured when deploying) an informative mail including the Risk history of this user, given by Azure AD Identity Protection.
|
||||
Than it offers an option to confirm this user as compromised, dismiss it from being a risky user or ignore, by one button click.
|
||||
|
||||
!['LogicApps Designer view'](/images/desginerView.png)
|
||||
<img src="https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FIdentityProtection-EmailBotResponse/images/designerView.png"/>
|
||||
|
||||
Note: Azure AD Identity Protection is a premium feature. You need an Azure AD Premium P1 or P2 license to access the riskDetection API (note: P1 licenses receive limited risk information). The riskyUsers API is only available to Azure AD Premium P2 licenses only.
|
||||
|
||||
|
@ -20,9 +20,9 @@ Documentation references:
|
|||
</li>
|
||||
|
||||
|
||||
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FIdentityProtection-TeamsBotResponse%2Fazuredeploy.json" target="_blank">
|
||||
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FIdentityProtection-EmailResponse%2Fazuredeploy.json" target="_blank">
|
||||
<img src="https://aka.ms/deploytoazurebutton""/>
|
||||
</a>
|
||||
<a href="https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FIdentityProtection-TeamsBotResponse%2Fazuredeploy.json" target="_blank">
|
||||
<a href="https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FIdentityProtection-EmailResponse%2Fazuredeploy.json" target="_blank">
|
||||
<img src="https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazuregov.png"/>
|
||||
</a>
|
||||
|
|
|
@ -8,23 +8,23 @@ The Microsoft Teams bot will post an adaptive card in the SOC channel, including
|
|||
|
||||
Note: Azure AD Identity Protection is a premium feature. You need an Azure AD Premium P1 or P2 license to access the riskDetection API (note: P1 licenses receive limited risk information). The riskyUsers API is only available to Azure AD Premium P2 licenses only.
|
||||
|
||||
|
||||
<br><br>
|
||||
Overall:
|
||||
!['LogicApps Designer view']('./images/designerView.png')
|
||||
|
||||
<img src="https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FIdentityProtection-TeamsBotResponse/images/designerView.png"/>
|
||||
<br><br>
|
||||
Card to be sent by Microsoft Teams bot:
|
||||
!['LogicApps Designer view']('./images/msg.png')
|
||||
<img src="https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FIdentityProtection-TeamsBotResponse/images/msg.png"/><br><br>
|
||||
|
||||
Response Part:
|
||||
!['LogicApps Designer view']('./images/responsePart.png')
|
||||
|
||||
<img src="https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FIdentityProtection-TeamsBotResponse/images/responsePart.png"/>
|
||||
<br><br>
|
||||
Documentation references:
|
||||
|
||||
<li>Azure AD Identity Protection:
|
||||
<ul>
|
||||
<li><a href="https://docs.microsoft.com/azure/active-directory/identity-protection/overview-identity-protection" target="_blank" rel="noopener">Learn more about Identity Protection</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
</li><br><br>
|
||||
|
||||
|
||||
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FIdentityProtection-TeamsBotResponse%2Fazuredeploy.json" target="_blank">
|
||||
|
|
Загрузка…
Ссылка в новой задаче