Removed private preview in screenshots and workflow for entity trigger
|
@ -85,7 +85,7 @@
|
|||
"location": "[resourceGroup().location]",
|
||||
"tags": {
|
||||
"LogicAppsCategory": "security",
|
||||
"hidden-SentinelTemplateName": "Get-MDEInvestigationPackage",
|
||||
"hidden-SentinelTemplateName": "Get-MDEInvestigationPackage-Entity-Trigger",
|
||||
"hidden-SentinelTemplateVersion": "1.0"
|
||||
},
|
||||
"identity": {
|
||||
|
@ -116,7 +116,7 @@
|
|||
}
|
||||
},
|
||||
"triggers": {
|
||||
"Microsoft_Sentinel_entity_(Private_Preview)": {
|
||||
"Microsoft_Sentinel_entity": {
|
||||
"type": "ApiConnectionWebhook",
|
||||
"inputs": {
|
||||
"body": {
|
||||
|
|
До Ширина: | Высота: | Размер: 60 KiB |
До Ширина: | Высота: | Размер: 61 KiB После Ширина: | Высота: | Размер: 55 KiB |
До Ширина: | Высота: | Размер: 60 KiB После Ширина: | Высота: | Размер: 54 KiB |
|
@ -2,7 +2,7 @@
|
|||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
||||
"contentVersion": "1.0.0.0",
|
||||
"metadata": {
|
||||
"title": "Block AAD user - Entity",
|
||||
"title": "Block AAD user - Entity trigger",
|
||||
"description": "This playbook can be invoked on any account entity, and this will disable the user (account) in Azure Active Directoy, add a comment to the incident that contains this alert (incase invoked in incident context ) and notify manager if available. Note: This playbook will not disable admin user!",
|
||||
"prerequisites": [ "None" ],
|
||||
"postDeployment": [ "1. Assign Microsoft Sentinel Responder role to the Playbook's managed identity.", "2. Grant User.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All permissions to the managed identity.", "3. Authorize Azure AD and Office 365 Outlook Logic App connections." ],
|
||||
|
@ -25,7 +25,7 @@
|
|||
},
|
||||
"parameters": {
|
||||
"PlaybookName": {
|
||||
"defaultValue": "Block-AADUser-Entity",
|
||||
"defaultValue": "Block-AADUser-EntityTrigger",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
|
@ -83,7 +83,7 @@
|
|||
"location": "[resourceGroup().location]",
|
||||
"tags": {
|
||||
"LogicAppsCategory": "security",
|
||||
"hidden-SentinelTemplateName": "Block-AADUser",
|
||||
"hidden-SentinelTemplateName": "Block-AADUser-EntityTrigger",
|
||||
"hidden-SentinelTemplateVersion": "1.1"
|
||||
},
|
||||
"identity": {
|
||||
|
@ -106,7 +106,7 @@
|
|||
}
|
||||
},
|
||||
"triggers": {
|
||||
"Microsoft_Sentinel_entity_(Private_Preview)": {
|
||||
"Microsoft_Sentinel_entity": {
|
||||
"type": "ApiConnectionWebhook",
|
||||
"inputs": {
|
||||
"body": {
|
||||
|
|
До Ширина: | Высота: | Размер: 76 KiB После Ширина: | Высота: | Размер: 79 KiB |
До Ширина: | Высота: | Размер: 76 KiB После Ширина: | Высота: | Размер: 80 KiB |
До Ширина: | Высота: | Размер: 51 KiB После Ширина: | Высота: | Размер: 55 KiB |
До Ширина: | Высота: | Размер: 52 KiB После Ширина: | Высота: | Размер: 55 KiB |
|
@ -2,7 +2,7 @@
|
|||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
||||
"contentVersion": "1.0.0.0",
|
||||
"metadata": {
|
||||
"title": "Reset Azure AD User Password - Entity Trigger",
|
||||
"title": "Reset Azure AD User Password - Entity trigger",
|
||||
"description": "This playbook will reset the user password using Graph API. It will send the password (which is a random guid substring) to the user's manager. The user will have to reset the password upon login.",
|
||||
"postDeployment": [ "1. Assign Password Administrator permission to managed identity.", "2. Assign Microsoft Sentinel Responder permission to managed identity.", "3. Authorize Office 365 Outlook connection" ],
|
||||
"lastUpdateTime": "2022-12-06T00:00:00.000Z",
|
||||
|
@ -19,7 +19,7 @@
|
|||
},
|
||||
"parameters": {
|
||||
"PlaybookName": {
|
||||
"defaultValue": "Reset-AADPassword-EntityTrigger",
|
||||
"defaultValue": "Reset-AADUserPassword-EntityTrigger",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
|
@ -305,7 +305,7 @@
|
|||
"location": "[resourceGroup().location]",
|
||||
"tags": {
|
||||
"LogicAppsCategory": "security",
|
||||
"hidden-SentinelTemplateName": "Reset-AADUserPassword",
|
||||
"hidden-SentinelTemplateName": "Reset-AADUserPassword-EntityTrigger",
|
||||
"hidden-SentinelTemplateVersion": "1.1"
|
||||
},
|
||||
"identity": {
|
||||
|
|
До Ширина: | Высота: | Размер: 49 KiB После Ширина: | Высота: | Размер: 52 KiB |
До Ширина: | Высота: | Размер: 48 KiB После Ширина: | Высота: | Размер: 54 KiB |
|
@ -2,7 +2,7 @@
|
|||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
||||
"contentVersion": "1.0.0.0",
|
||||
"metadata": {
|
||||
"title": "BlockIP-Azure Firewall New Rule",
|
||||
"title": "BlockIP-Azure Firewall New Rule - Entity trigger",
|
||||
"description": "This playbook uses the Azure Firewall connector to add IP Address to the Deny Network Rules collection based on the Microsoft Sentinel Incident",
|
||||
"mainSteps:": [
|
||||
"When a new Sentinel incident is created:",
|
||||
|
@ -62,7 +62,7 @@
|
|||
},
|
||||
"parameters": {
|
||||
"PlaybookName": {
|
||||
"defaultValue": "AzureFirewall-BlockIP-addNewRule",
|
||||
"defaultValue": "AzureFirewall-BlockIP-addNewRule-EntityTrigger",
|
||||
"type": "string",
|
||||
"metadata": {
|
||||
"description": "Name of the Logic App or Playbook"
|
||||
|
@ -126,7 +126,7 @@
|
|||
}
|
||||
},
|
||||
"triggers": {
|
||||
"Microsoft_Sentinel_entity_(Private_Preview)": {
|
||||
"Microsoft_Sentinel_entity": {
|
||||
"type": "ApiConnectionWebhook",
|
||||
"inputs": {
|
||||
"body": {
|
||||
|
@ -797,7 +797,7 @@
|
|||
"type": "Microsoft.Logic/workflows",
|
||||
"location": "[resourceGroup().location]",
|
||||
"tags": {
|
||||
"hidden-SentinelTemplateName": "AzureFirewall-BlockIP-addNewRule",
|
||||
"hidden-SentinelTemplateName": "AzureFirewall-BlockIP-addNewRule-EntityTrigger",
|
||||
"hidden-SentinelTemplateVersion": "1.0"
|
||||
},
|
||||
"identity": {
|
||||
|
|
До Ширина: | Высота: | Размер: 72 KiB После Ширина: | Высота: | Размер: 157 KiB |
До Ширина: | Высота: | Размер: 66 KiB После Ширина: | Высота: | Размер: 162 KiB |
|
@ -65,7 +65,7 @@
|
|||
},
|
||||
"parameters": {
|
||||
"PlaybookName": {
|
||||
"defaultValue": "AzureFirewall-BlockIP-addToIPGroup",
|
||||
"defaultValue": "AzureFirewall-BlockIP-addToIPGroup-EntityTrigger",
|
||||
"type": "string"
|
||||
},
|
||||
"CustomConnectorName": {
|
||||
|
@ -538,7 +538,7 @@
|
|||
"type": "Microsoft.Logic/workflows",
|
||||
"location": "[resourceGroup().location]",
|
||||
"tags": {
|
||||
"hidden-SentinelTemplateName": "AzureFirewall-BlockIP-addToIPGroup",
|
||||
"hidden-SentinelTemplateName": "AzureFirewall-BlockIP-addToIPGroup-EntityTrigger",
|
||||
"hidden-SentinelTemplateVersion": "1.0"
|
||||
},
|
||||
"identity": {
|
||||
|
|
До Ширина: | Высота: | Размер: 112 KiB После Ширина: | Высота: | Размер: 198 KiB |
До Ширина: | Высота: | Размер: 134 KiB После Ширина: | Высота: | Размер: 197 KiB |
|
@ -19,7 +19,7 @@
|
|||
},
|
||||
"parameters": {
|
||||
"PlaybookName": {
|
||||
"defaultValue": "PaloAlto-PAN-OS-BlockIP-Entity",
|
||||
"defaultValue": "PaloAlto-PAN-OS-BlockIP-EntityTrigger",
|
||||
"type": "String",
|
||||
"metadata": {
|
||||
"description": "Name of the Logic App/Playbook"
|
||||
|
|
До Ширина: | Высота: | Размер: 68 KiB После Ширина: | Высота: | Размер: 65 KiB |
До Ширина: | Высота: | Размер: 70 KiB После Ширина: | Высота: | Размер: 64 KiB |
|
@ -3,7 +3,7 @@
|
|||
"contentVersion": "1.0.0.0",
|
||||
"metadata": {
|
||||
"comments": "This playbook uses the PaloAlto connector to take necessary actions on URL address like Block URL/Unblock URL from predefined address group and also gives an option to close the incident.",
|
||||
"title": "PaloAlto-PAN-OS-BlockURL-Entity",
|
||||
"title": "PaloAlto-PAN-OS-BlockURL-EntityTrigger",
|
||||
"description": "This playbook allows blocking/unblocking URLs in PaloAlto, using **predefined address group**. This allows to make changes on predefined address group, which is attached to security policy rule.",
|
||||
"prerequisites": [ "1. PaloAlto connector needs to be deployed prior to the deployment of this playbook under the same subscription. Relevant instructions can be found in the connector doc page. \n\n 2. Generate an API key.[Refer this link on how to generate the API Key](https://paloaltolactest.trafficmanager.net/restapi-doc/#tag/key-generation) \n\n 3. Address group should be created for PAN-OS and this should be used while creating playbooks." ],
|
||||
"mainSteps": [ "When a new Sentinel incident is created, this playbook gets triggered and performs below actions: \n\n 1. An adaptive card is sent to the SOC channel providing Incident information, URL address, list of existing security policy rules in which URL is a member of and provides an option to Block/Unblock URL Address by adding/removing it to/from the predefined address group. \n\n 2. The SOC can act on risky URL based on the information provided in the adaptive card, or ignore. \n\n ![PaloAlto-PAN-OS-BlockURL](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAlto-PAN-OS/Playbooks/PaloAlto-PAN-OS-BlockURL/designerscreenshot.PNG?raw=true) \n\n **This is the adaptive card SOC will receive when playbook is triggered for each risky URL for taking actions like block/unblock/ignore ::** \n\n ![Adaptive Card example](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAlto-PAN-OS/Playbooks/PaloAlto-PAN-OS-BlockURL/AdaptiveCardtoBlockorUnblock.PNG?raw=true) \n\n **This is the consolidate adaptive card about the summary of actions taken on URL and the incident configuration ::** \n\n ![Consolidated Adaptive Card example](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAlto-PAN-OS/Playbooks/PaloAlto-PAN-OS-BlockURL/SummarizedAdaptiveCard.PNG?raw=true)" ],
|
||||
|
@ -20,7 +20,7 @@
|
|||
"releaseNotes": [
|
||||
{
|
||||
"version": "1.0.0",
|
||||
"title": "PaloAlto-PAN-OS-BlockURL-Entity",
|
||||
"title": "PaloAlto-PAN-OS-BlockURL-EntityTrigger",
|
||||
"notes": [
|
||||
"Initial version"
|
||||
]
|
||||
|
@ -29,7 +29,7 @@
|
|||
},
|
||||
"parameters": {
|
||||
"PlaybookName": {
|
||||
"defaultValue": "PaloAlto-PAN-OS-BlockURL-Entity",
|
||||
"defaultValue": "PaloAlto-PAN-OS-BlockURL-EntityTrigger",
|
||||
"type": "String",
|
||||
"metadata": {
|
||||
"description": "Name of the Logic App/Playbook"
|
||||
|
@ -132,7 +132,7 @@
|
|||
}
|
||||
},
|
||||
"triggers": {
|
||||
"Microsoft_Sentinel_entity_(Private_Preview)": {
|
||||
"Microsoft_Sentinel_entity": {
|
||||
"type": "ApiConnectionWebhook",
|
||||
"inputs": {
|
||||
"body": {
|
||||
|
|
До Ширина: | Высота: | Размер: 68 KiB После Ширина: | Высота: | Размер: 66 KiB |
До Ширина: | Высота: | Размер: 70 KiB После Ширина: | Высота: | Размер: 65 KiB |