Azure
/
Azure-Sentinel
зеркало из
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Fixed a VT Schema change. 

- The ASN value did was causing an issue when processing the VT payload. Looks like the Schema may have changed.
- Updated and included the complete VT IP response schema
- Updated The incident comment that is made to reflect a change in the VT Schema
This commit is contained in:
Joe Stahl 2020-11-11 12:07:41 -05:00 коммит произвёл GitHub
Родитель a892ab8781
Коммит 5c52fd52f0
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: 4AEE18F83AFDEB23
1 изменённых файлов: 110 добавлений и 11 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

121
Playbooks/Get-IPReputation/azuredeploy.json
Просмотреть файл

@ -144,7 +144,7 @@
"type": "ApiConnection",
"inputs": {
"body": {
"Value": "VTIPReport found for @{items('For_each')?['Address']}, Query: VTIPReport_CL | where asn_s == \"@{body('Parse_JSON')?['asn']}\" and country_s == \"@{body('Parse_JSON')?['country']}\""
"Value": "VTIPReport found for @{items('For_each')?['Address']}, Query: VTIPReport_CL | where asn_d == \"@{body('Parse_JSON')?['asn']}\" and country_s == \"@{body('Parse_JSON')?['country']}\""
},
"host": {
"connection": {
@ -230,17 +230,116 @@
"content": "@body('HTTP')",
"schema": {
"properties": {
"asn": {
"type": "string"
"content": {
"properties": {
"as_owner": {
"type": "string"
},
"asn": {
"type": "integer"
},
"country": {
"type": "string"
},
"detected_downloaded_samples": {
"type": "array"
},
"detected_urls": {
"items": {
"properties": {
"positives": {
"type": "integer"
},
"scan_date": {
"type": "string"
},
"total": {
"type": "integer"
},
"url": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
},
"resolutions": {
"items": {
"properties": {
"hostname": {
"type": "string"
},
"last_resolved": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
},
"response_code": {
"type": "integer"
},
"undetected_downloaded_samples": {
"type": "array"
},
"undetected_urls": {
"items": {
"type": "array"
},
"type": "array"
},
"verbose_msg": {
"type": "string"
}
},
"type": "object"
},
"country": {
"type": "string"
},
"response_code": {
"type": "integer"
},
"verbose_msg": {
"type": "string"
"schema": {
"properties": {
"properties": {
"properties": {
"asn": {
"properties": {
"type": {
"type": "string"
}
},
"type": "object"
},
"country": {
"properties": {
"type": {
"type": "string"
}
},
"type": "object"
},
"response_code": {
"properties": {
"type": {
"type": "string"
}
},
"type": "object"
},
"verbose_msg": {
"properties": {
"type": {
"type": "string"
}
},
"type": "object"
}
},
"type": "object"
},
"type": {
"type": "string"
}
},
"type": "object"
}
},
"type": "object"