Add files via upload
This commit is contained in:
AcceleryntSecurityDev
GitHub
Родитель
729e0e7d16
Коммит
38b7fd33dc
|
|
@ -0,0 +1,84 @@
|
|||
# AS-Azure-AD-Group
|
||||
Author: Accelerynt
|
||||
|
||||
For any technical questions, please contact info@accelerynt.com
|
||||
|
||||
[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAccelerynt-Security%2FAS-Azure-AD-Group%2Fmaster%2Fazuredeploy.json)
|
||||
[](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAccelerynt-Security%2FAS-Azure-AD-Group%2Fmaster%2Fazuredeploy.json)
|
||||
|
||||
This playbook is intended to be run from a Microsoft Sentinel incident. It will add accounts from Microsoft Sentinel incidents to an Azure AD Group of your choice.
|
||||
|
||||
|
||||
|
||||
|
||||
#
|
||||
### Requirements
|
||||
|
||||
The following items are required under the template settings during deployment:
|
||||
|
||||
* The [id](https://github.com/Accelerynt-Security/AS-Azure-AD-Group#azure-active-directory-group-id) of your Azure Active Directory group
|
||||
|
||||
#
|
||||
### Setup
|
||||
|
||||
#### Azure Active Directory Group Id:
|
||||
|
||||
Before deployment, you will need to note the Id of the Azure Active Directory group you would like the playbook to use.
|
||||
|
||||
Navigate to the Azure Active Directory Groups page: https://portal.azure.com/#view/Microsoft_AAD_IAM/GroupsManagementMenuBlade/~/AllGroups
|
||||
|
||||
Click the desired group and from the overview page, copy the value of the "**Object Id**" field.
|
||||
|
||||
|
||||
|
||||
#
|
||||
### Deployment
|
||||
|
||||
To configure and deploy this playbook:
|
||||
|
||||
Open your browser and ensure you are logged into your Microsoft Sentinel workspace. In a separate tab, open the link to our playbook on the Arbala Security GitHub Repository:
|
||||
|
||||
https://github.com/Accelerynt-Security/AS-Azure-AD-Group
|
||||
|
||||
[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAccelerynt-Security%2FAS-Azure-AD-Group%2Fmaster%2Fazuredeploy.json)
|
||||
[](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAccelerynt-Security%2FAS-Azure-AD-Group%2Fmaster%2Fazuredeploy.json)
|
||||
|
||||
Click the “**Deploy to Azure**” button at the bottom and it will bring you to the custom deployment template.
|
||||
|
||||
In the **Project Details** section:
|
||||
|
||||
* Select the “**Subscription**” and “**Resource Group**” from the dropdown boxes you would like the playbook deployed to.
|
||||
|
||||
In the **Instance Details** section:
|
||||
|
||||
* **Playbook Name**: This can be left as "**AS-Azure-AD-Group**" or you may change it.
|
||||
|
||||
* **Group Id**: Enter the Id copied from the setup step
|
||||
|
||||
Towards the bottom, click on “**Review + create**”.
|
||||
|
||||
|
||||
|
||||
Once the resources have validated, click on "**Create**".
|
||||
|
||||
|
||||
|
||||
The resources should take around a minute to deploy. Once the deployment is complete, you can expand the "**Deployment details**" section to view them.
|
||||
Click the one corresponding to the Logic App.
|
||||
|
||||
|
||||
|
||||
Click on the “**Edit**” button. This will bring us into the Logic Apps Designer.
|
||||
|
||||
|
||||
|
||||
Before the playbook can be run, the Azure AD connection will either need to be authorized in the indicated step, or an existing authorized connection may be alternatively selected. This connection can be found under the third step labeled "**For each**".
|
||||
|
||||
|
||||
|
||||
Expand the "**Connections**" step and click the exclamation point icon next to the name matching the playbook.
|
||||
|
||||
|
||||
|
||||
When prompted, sign in to validate the connection.
|
||||
|
||||
|
|
@ -0,0 +1,175 @@
|
|||
{
|
||||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
||||
"contentVersion": "1.0.0.0",
|
||||
"metadata": {
|
||||
"title": "AS-Azure-AD-Group",
|
||||
"description": "This playbook is intended to be run from a Microsoft Sentinel incident. It will add the users associated with the accounts from Microsoft Sentinel incidents to an Azure Active Directory Group of your choosing.",
|
||||
"lastUpdateTime": "2022-10-17T18:18:05Z",
|
||||
"entities": ["Account"],
|
||||
"tags": ["Microsoft Sentinel", "Incident", "Azure Active Directory", "Groups"],
|
||||
"support": {
|
||||
"tier": "developer"
|
||||
},
|
||||
"author": {
|
||||
"name": "Accelerynt"
|
||||
}
|
||||
},
|
||||
"parameters": {
|
||||
"PlaybookName": {
|
||||
"defaultValue": "AS-Azure-AD-Group",
|
||||
"type": "string"
|
||||
},
|
||||
"GroupId": {
|
||||
"type": "string",
|
||||
"metadata": {
|
||||
"description": "Id of the Azure Active Directory group account users will be added to"
|
||||
}
|
||||
}
|
||||
},
|
||||
"variables": {
|
||||
"azuread": "[concat('azuread-', parameters('PlaybookName'))]",
|
||||
"azuresentinel": "[concat('azuresentinel-', parameters('PlaybookName'))]"
|
||||
|
||||
},
|
||||
"resources": [
|
||||
{
|
||||
"type": "Microsoft.Web/connections",
|
||||
"apiVersion": "2016-06-01",
|
||||
"name": "[variables('azuread')]",
|
||||
"location": "[resourceGroup().location]",
|
||||
"kind": "V1",
|
||||
"properties": {
|
||||
"displayName": "[parameters('PlaybookName')]",
|
||||
"customParameterValues": {},
|
||||
"api": {
|
||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuread')]"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"type": "Microsoft.Web/connections",
|
||||
"apiVersion": "2016-06-01",
|
||||
"name": "[variables('azuresentinel')]",
|
||||
"location": "[resourceGroup().location]",
|
||||
"kind": "V1",
|
||||
"properties": {
|
||||
"displayName": "[parameters('PlaybookName')]",
|
||||
"customParameterValues": {},
|
||||
"parameterValueType": "Alternative",
|
||||
"api": {
|
||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"type": "Microsoft.Logic/workflows",
|
||||
"apiVersion": "2017-07-01",
|
||||
"name": "[parameters('PlaybookName')]",
|
||||
"location": "[resourceGroup().location]",
|
||||
"tags": {
|
||||
"LogicAppsCategory": "security"
|
||||
},
|
||||
"identity": {
|
||||
"type": "SystemAssigned"
|
||||
},
|
||||
"dependsOn": [
|
||||
"[resourceId('Microsoft.Web/connections', variables('azuread'))]",
|
||||
"[resourceId('Microsoft.Web/connections', variables('azuresentinel'))]"
|
||||
],
|
||||
"properties": {
|
||||
"state": "Enabled",
|
||||
"definition": {
|
||||
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
|
||||
"contentVersion": "1.0.0.0",
|
||||
"parameters": {
|
||||
"$connections": {
|
||||
"defaultValue": {},
|
||||
"type": "Object"
|
||||
}
|
||||
},
|
||||
"triggers": {
|
||||
"Microsoft_Sentinel_incident": {
|
||||
"type": "ApiConnectionWebhook",
|
||||
"inputs": {
|
||||
"body": {
|
||||
"callback_url": "@{listCallbackUrl()}"
|
||||
},
|
||||
"host": {
|
||||
"connection": {
|
||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
||||
}
|
||||
},
|
||||
"path": "/incident-creation"
|
||||
}
|
||||
}
|
||||
},
|
||||
"actions": {
|
||||
"Entities_-_Get_Accounts": {
|
||||
"runAfter": {},
|
||||
"type": "ApiConnection",
|
||||
"inputs": {
|
||||
"body": "@triggerBody()?['object']?['properties']?['relatedEntities']",
|
||||
"host": {
|
||||
"connection": {
|
||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
||||
}
|
||||
},
|
||||
"method": "post",
|
||||
"path": "/entities/account"
|
||||
}
|
||||
},
|
||||
"For_each": {
|
||||
"foreach": "@body('Entities_-_Get_Accounts')?['Accounts']",
|
||||
"actions": {
|
||||
"Add_user_to_group": {
|
||||
"runAfter": {},
|
||||
"type": "ApiConnection",
|
||||
"inputs": {
|
||||
"body": {
|
||||
"@@odata.id": "@items('For_each')?['AadUserId']"
|
||||
},
|
||||
"host": {
|
||||
"connection": {
|
||||
"name": "@parameters('$connections')['azuread']['connectionId']"
|
||||
}
|
||||
},
|
||||
"method": "post",
|
||||
"path": "[concat('/v1.0/groups/@{encodeURIComponent(''', parameters('GroupId'), ''')}/members/$ref')]"
|
||||
}
|
||||
}
|
||||
},
|
||||
"runAfter": {
|
||||
"Entities_-_Get_Accounts": [
|
||||
"Succeeded"
|
||||
]
|
||||
},
|
||||
"type": "Foreach"
|
||||
}
|
||||
},
|
||||
"outputs": {}
|
||||
},
|
||||
"parameters": {
|
||||
"$connections": {
|
||||
"value": {
|
||||
"azuread": {
|
||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('azuread'))]",
|
||||
"connectionName": "[variables('azuread')]",
|
||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuread')]"
|
||||
},
|
||||
"azuresentinel": {
|
||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('azuresentinel'))]",
|
||||
"connectionName": "[variables('azuresentinel')]",
|
||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]",
|
||||
"connectionProperties": {
|
||||
"authentication": {
|
||||
"type": "ManagedServiceIdentity"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
Загрузка…
Ссылка в новой задаче