Update-RiskyUserWatchlist
New Logic watchlist add/update - timer based this logic app weekly connects to Defender for Cloud App and pulls risky users, some user context information, threat score, and direct user url.
This commit is contained in:
swiftsolves-msft
Родитель
f2a6270b40
Коммит
9a52f7f541
|
|
@ -0,0 +1,666 @@
|
|||
{
|
||||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
||||
"contentVersion": "1.0.0.0",
|
||||
"metadata":{
|
||||
"comments": "This Logic App will run weekly and create/update a Risky User watchlist with users from Microsoft Defender for cloud app with additional data for threatscore, information, and a url",
|
||||
"author": "Jhonny Paulino, Nathan Swift"
|
||||
},
|
||||
"parameters": {
|
||||
"PlaybookName": {
|
||||
"defaultValue": "Update-RiskyUserWatchlist",
|
||||
"type": "string"
|
||||
},
|
||||
"CloudAppAADServicePrincipal": {
|
||||
"defaultValue": "Azure AD Service principal AppId",
|
||||
"type": "securestring"
|
||||
},
|
||||
"KeyVaultName": {
|
||||
"defaultValue": "kevaultname-to-create",
|
||||
"type": "string"
|
||||
},
|
||||
"CloudAppAADServicePrincipalSecretKey": {
|
||||
"defaultValue": "Azure AD Service principal key for keyvault secret",
|
||||
"type": "securestring"
|
||||
},
|
||||
"MCASURL": {
|
||||
"defaultValue": "https://xxxxxxx.yyy.portal.cloudappsecurity.com",
|
||||
"type": "string"
|
||||
},
|
||||
"SubscriptionID": {
|
||||
"defaultValue": "Your Subscription ID of Microsoft Sentinel",
|
||||
"type": "string"
|
||||
},
|
||||
"WorkspaceID": {
|
||||
"defaultValue": "Your Log analytics workspace ID of Microsoft Sentinel",
|
||||
"type": "string"
|
||||
},
|
||||
"WorkspaceRGName": {
|
||||
"defaultValue": "Your Log analytics workspace resource group of Microsoft Sentinel",
|
||||
"type": "string"
|
||||
},
|
||||
"TenantID": {
|
||||
"defaultValue": "Your Tenant ID of Defender for Cloud App",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"variables": {
|
||||
"secretName": "cloudapplist",
|
||||
"azuresentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]",
|
||||
"keyvaultConnectionName": "[concat('keyvault-', parameters('PlaybookName'))]"
|
||||
},
|
||||
"resources": [
|
||||
{
|
||||
"type": "Microsoft.Web/connections",
|
||||
"apiVersion": "2016-06-01",
|
||||
"name": "[variables('azuresentinelConnectionName')]",
|
||||
"location": "[resourceGroup().location]",
|
||||
"kind": "V1",
|
||||
"properties": {
|
||||
"displayName": "SentinelMSI",
|
||||
"parameterValueType": "Alternative",
|
||||
"customParameterValues": {},
|
||||
"api": {
|
||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"type": "Microsoft.Web/connections",
|
||||
"apiVersion": "2016-06-01",
|
||||
"name": "[variables('keyvaultConnectionName')]",
|
||||
"location": "[resourceGroup().location]",
|
||||
"kind": "V1",
|
||||
"properties": {
|
||||
"displayName": "KeyvaultMSI",
|
||||
"parameterValueType": "Alternative",
|
||||
"customParameterValues": {},
|
||||
"api": {
|
||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/keyvault')]"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"type": "Microsoft.KeyVault/vaults",
|
||||
"apiVersion": "2021-11-01-preview",
|
||||
"name": "[parameters('KeyVaultName')]",
|
||||
"location": "[resourceGroup().location]",
|
||||
"properties": {
|
||||
"sku": {
|
||||
"family": "A",
|
||||
"name": "Standard"
|
||||
},
|
||||
"tenantId": "[parameters('TenantID')]",
|
||||
"accessPolicies": [],
|
||||
"enabledForDeployment": false,
|
||||
"enabledForDiskEncryption": false,
|
||||
"enabledForTemplateDeployment": false,
|
||||
"enableSoftDelete": true,
|
||||
"softDeleteRetentionInDays": 90,
|
||||
"enableRbacAuthorization": true,
|
||||
"publicNetworkAccess": "Enabled"
|
||||
}
|
||||
},
|
||||
{
|
||||
"type": "Microsoft.KeyVault/vaults/secrets",
|
||||
"apiVersion": "2021-11-01-preview",
|
||||
"name": "[format('{0}/{1}', parameters('KeyVaultName'), variables('secretName'))]",
|
||||
"properties": {
|
||||
"value": "[parameters('CloudAppAADServicePrincipalSecretKey')]"
|
||||
},
|
||||
"dependsOn": [
|
||||
"[resourceId('Microsoft.KeyVault/vaults', parameters('KeyVaultName'))]"
|
||||
]
|
||||
},
|
||||
{
|
||||
"type": "Microsoft.Logic/workflows",
|
||||
"apiVersion": "2017-07-01",
|
||||
"name": "[parameters('PlaybookName')]",
|
||||
"location": "[resourceGroup().location]",
|
||||
"tags": {
|
||||
"LogicAppsCategory": "security"
|
||||
},
|
||||
"dependsOn": [
|
||||
"[resourceId('Microsoft.Web/connections', variables('azuresentinelConnectionName'))]",
|
||||
"[resourceId('Microsoft.Web/connections', variables('keyvaultConnectionName'))]"
|
||||
],
|
||||
"identity": {
|
||||
"type": "SystemAssigned"
|
||||
},
|
||||
"properties": {
|
||||
"state": "Enabled",
|
||||
"definition": {
|
||||
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
|
||||
"contentVersion": "1.0.0.0",
|
||||
"parameters": {
|
||||
"$connections": {
|
||||
"defaultValue": {},
|
||||
"type": "Object"
|
||||
},
|
||||
"CloudAppAADServicePrincipal": {
|
||||
"defaultValue": "[parameters('CloudAppAADServicePrincipal')]",
|
||||
"type": "String"
|
||||
},
|
||||
"KeyVaultName": {
|
||||
"defaultValue": "[parameters('KeyVaultName')]",
|
||||
"type": "String"
|
||||
},
|
||||
"MCASURL": {
|
||||
"defaultValue": "[parameters('MCASURL')]",
|
||||
"type": "String"
|
||||
},
|
||||
"SubscriptionID": {
|
||||
"defaultValue": "[parameters('SubscriptionID')]",
|
||||
"type": "String"
|
||||
},
|
||||
"TenantID": {
|
||||
"defaultValue": "[parameters('TenantID')]",
|
||||
"type": "String"
|
||||
},
|
||||
"WorkspaceID": {
|
||||
"defaultValue": "[parameters('WorkspaceID')]",
|
||||
"type": "String"
|
||||
},
|
||||
"WorkspaceRGName": {
|
||||
"defaultValue": "[parameters('WorkspaceRGName')]",
|
||||
"type": "String"
|
||||
}
|
||||
},
|
||||
"triggers": {
|
||||
"Recurrence": {
|
||||
"recurrence": {
|
||||
"frequency": "Week",
|
||||
"interval": 1,
|
||||
"schedule": {
|
||||
"hours": [
|
||||
"6"
|
||||
]
|
||||
}
|
||||
},
|
||||
"evaluatedRecurrence": {
|
||||
"frequency": "Week",
|
||||
"interval": 1,
|
||||
"schedule": {
|
||||
"hours": [
|
||||
"6"
|
||||
]
|
||||
}
|
||||
},
|
||||
"type": "Recurrence"
|
||||
}
|
||||
},
|
||||
"actions": {
|
||||
"Condition": {
|
||||
"actions": {
|
||||
"Watchlists_-_Create_a_new_watchlist_with_data": {
|
||||
"runAfter": {},
|
||||
"type": "ApiConnection",
|
||||
"inputs": {
|
||||
"body": {
|
||||
"contentType": "text/csv",
|
||||
"description": "Cloud App risky users with threatscore, information, and user url",
|
||||
"displayName": "CloudAppRiskyUsers",
|
||||
"itemsSearchKey": "emailAddress",
|
||||
"numberOfLinesToSkip": 1,
|
||||
"provider": "Microsoft",
|
||||
"rawContent": "emailAddress, isAdmin, isExternal, threatScore, userCloudAppUrl\r\ntest, False, True, 0, https",
|
||||
"source": "Local file",
|
||||
"watchlistAlias": "cloudappriskyusers",
|
||||
"watchlistId": "@{guid()}"
|
||||
},
|
||||
"host": {
|
||||
"connection": {
|
||||
"name": "@parameters('$connections')['azuresentinel_1']['connectionId']"
|
||||
}
|
||||
},
|
||||
"method": "put",
|
||||
"path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('SubscriptionID'))}/resourceGroups/@{encodeURIComponent(parameters('WorkspaceRGName'))}/workspaces/@{encodeURIComponent(parameters('WorkspaceID'))}/watchlists/@{encodeURIComponent('cloudappriskyusers')}"
|
||||
}
|
||||
}
|
||||
},
|
||||
"runAfter": {
|
||||
"Watchlists_-_Get_a_watchlist_by_alias": [
|
||||
"Succeeded",
|
||||
"Failed"
|
||||
]
|
||||
},
|
||||
"else": {
|
||||
"actions": {
|
||||
"Delay": {
|
||||
"runAfter": {
|
||||
"Watchlists_-_Delete_a_watchlist": [
|
||||
"Succeeded"
|
||||
]
|
||||
},
|
||||
"type": "Wait",
|
||||
"inputs": {
|
||||
"interval": {
|
||||
"count": 2,
|
||||
"unit": "Minute"
|
||||
}
|
||||
}
|
||||
},
|
||||
"Watchlists_-_Create_a_new_watchlist_with_data_2": {
|
||||
"runAfter": {
|
||||
"Delay": [
|
||||
"Succeeded"
|
||||
]
|
||||
},
|
||||
"type": "ApiConnection",
|
||||
"inputs": {
|
||||
"body": {
|
||||
"contentType": "text/csv",
|
||||
"description": "Cloud App risky users with threatscore, information, and user url",
|
||||
"displayName": "CloudAppRiskyUsers",
|
||||
"itemsSearchKey": "emailAddress",
|
||||
"numberOfLinesToSkip": 1,
|
||||
"provider": "Microsoft",
|
||||
"rawContent": "emailAddress, isAdmin, isExternal, threatScore, userCloudAppUrl\r\ntest, False, True, 0, https",
|
||||
"source": "Local file",
|
||||
"watchlistAlias": "cloudappriskyusers",
|
||||
"watchlistId": "@{guid()}"
|
||||
},
|
||||
"host": {
|
||||
"connection": {
|
||||
"name": "@parameters('$connections')['azuresentinel_1']['connectionId']"
|
||||
}
|
||||
},
|
||||
"method": "put",
|
||||
"path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('SubscriptionID'))}/resourceGroups/@{encodeURIComponent(parameters('WorkspaceRGName'))}/workspaces/@{encodeURIComponent(parameters('WorkspaceID'))}/watchlists/@{encodeURIComponent('cloudappriskyusers')}"
|
||||
}
|
||||
},
|
||||
"Watchlists_-_Delete_a_watchlist": {
|
||||
"runAfter": {},
|
||||
"type": "ApiConnection",
|
||||
"inputs": {
|
||||
"host": {
|
||||
"connection": {
|
||||
"name": "@parameters('$connections')['azuresentinel_1']['connectionId']"
|
||||
}
|
||||
},
|
||||
"method": "delete",
|
||||
"path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('SubscriptionID'))}/resourceGroups/@{encodeURIComponent(parameters('WorkspaceRGName'))}/workspaces/@{encodeURIComponent(parameters('WorkspaceID'))}/watchlists/@{encodeURIComponent('cloudappriskyusers')}"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"expression": {
|
||||
"and": [
|
||||
{
|
||||
"equals": [
|
||||
"@body('Watchlists_-_Get_a_watchlist_by_alias')?['StatusCode']",
|
||||
"NotFound"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"type": "If"
|
||||
},
|
||||
"Delay_2": {
|
||||
"runAfter": {
|
||||
"Filter_array": [
|
||||
"Succeeded"
|
||||
]
|
||||
},
|
||||
"type": "Wait",
|
||||
"inputs": {
|
||||
"interval": {
|
||||
"count": 2,
|
||||
"unit": "Minute"
|
||||
}
|
||||
}
|
||||
},
|
||||
"Filter_array": {
|
||||
"runAfter": {
|
||||
"HTTP": [
|
||||
"Succeeded"
|
||||
]
|
||||
},
|
||||
"type": "Query",
|
||||
"inputs": {
|
||||
"from": "@body('HTTP')?['data']",
|
||||
"where": "@equals(item()?['type'], 2)"
|
||||
}
|
||||
},
|
||||
"For_each": {
|
||||
"foreach": "@body('Filter_array')",
|
||||
"actions": {
|
||||
"Compose": {
|
||||
"runAfter": {
|
||||
"Set_variable_3": [
|
||||
"Succeeded"
|
||||
]
|
||||
},
|
||||
"type": "Compose",
|
||||
"inputs": {
|
||||
"emailAddress": "@{body('Parse_JSON')?['email']}",
|
||||
"isAdmin": "@{body('Parse_JSON')?['isAdmin']}",
|
||||
"isExternal": "@{body('Parse_JSON')?['isExternal']}",
|
||||
"threatScore": "@{body('Parse_JSON')?['threatScore']}",
|
||||
"userCloudAppUrl": "@{variables('userCloudAppUrl')}"
|
||||
}
|
||||
},
|
||||
"Parse_JSON": {
|
||||
"runAfter": {},
|
||||
"type": "ParseJson",
|
||||
"inputs": {
|
||||
"content": "@items('For_each')",
|
||||
"schema": {
|
||||
"properties": {
|
||||
"_id": {
|
||||
"type": "string"
|
||||
},
|
||||
"actions": {
|
||||
"type": "array"
|
||||
},
|
||||
"appData": {
|
||||
"properties": {
|
||||
"appId": {
|
||||
"type": "integer"
|
||||
},
|
||||
"instance": {
|
||||
"type": "integer"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"saas": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"displayName": {
|
||||
"type": "string"
|
||||
},
|
||||
"domain": {},
|
||||
"email": {},
|
||||
"id": {
|
||||
"type": "string"
|
||||
},
|
||||
"idType": {
|
||||
"type": "integer"
|
||||
},
|
||||
"identifiers": {
|
||||
"type": "array"
|
||||
},
|
||||
"ii": {
|
||||
"type": "string"
|
||||
},
|
||||
"isAdmin": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"isExternal": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"isFake": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"organization": {},
|
||||
"role": {},
|
||||
"scoreTrends": {},
|
||||
"sctime": {},
|
||||
"sid": {},
|
||||
"status": {},
|
||||
"subApps": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"appId": {
|
||||
"type": "integer"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"appId",
|
||||
"name"
|
||||
],
|
||||
"type": "object"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"threatScore": {},
|
||||
"type": {
|
||||
"type": "integer"
|
||||
},
|
||||
"userGroups": {
|
||||
"items": {
|
||||
"properties": {
|
||||
"_id": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": {
|
||||
"type": "string"
|
||||
},
|
||||
"id": {
|
||||
"type": "string"
|
||||
},
|
||||
"name": {
|
||||
"type": "string"
|
||||
},
|
||||
"usersCount": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"_id",
|
||||
"id",
|
||||
"name",
|
||||
"description",
|
||||
"usersCount"
|
||||
],
|
||||
"type": "object"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"username": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
}
|
||||
},
|
||||
"Set_variable": {
|
||||
"runAfter": {
|
||||
"Parse_JSON": [
|
||||
"Succeeded"
|
||||
]
|
||||
},
|
||||
"type": "SetVariable",
|
||||
"inputs": {
|
||||
"name": "userCloudAppB64Input",
|
||||
"value": "{\"id\":\"@{body('Parse_JSON')?['id']}\",\"saas\":@{body('Parse_JSON')?['appData']?['saas']},\"inst\":@{body('Parse_JSON')?['appData']?['instance']}}"
|
||||
}
|
||||
},
|
||||
"Set_variable_2": {
|
||||
"runAfter": {
|
||||
"Set_variable": [
|
||||
"Succeeded"
|
||||
]
|
||||
},
|
||||
"type": "SetVariable",
|
||||
"inputs": {
|
||||
"name": "userCloudAppB64Output",
|
||||
"value": "@{base64(variables('userCloudAppB64Input'))}"
|
||||
}
|
||||
},
|
||||
"Set_variable_3": {
|
||||
"runAfter": {
|
||||
"Set_variable_2": [
|
||||
"Succeeded"
|
||||
]
|
||||
},
|
||||
"type": "SetVariable",
|
||||
"inputs": {
|
||||
"name": "userCloudAppUrl",
|
||||
"value": "@{parameters('MCASURL')}/#/users/@{variables('userCloudAppB64Output')}"
|
||||
}
|
||||
},
|
||||
"Watchlists_-_Add_a_new_watchlist_item": {
|
||||
"runAfter": {
|
||||
"Compose": [
|
||||
"Succeeded"
|
||||
]
|
||||
},
|
||||
"type": "ApiConnection",
|
||||
"inputs": {
|
||||
"body": "@outputs('Compose')",
|
||||
"host": {
|
||||
"connection": {
|
||||
"name": "@parameters('$connections')['azuresentinel_1']['connectionId']"
|
||||
}
|
||||
},
|
||||
"method": "put",
|
||||
"path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('SubscriptionID'))}/resourceGroups/@{encodeURIComponent(parameters('WorkspaceRGName'))}/workspaces/@{encodeURIComponent(parameters('WorkspaceID'))}/watchlists/@{encodeURIComponent('cloudappriskyusers')}/watchlistItem"
|
||||
}
|
||||
}
|
||||
},
|
||||
"runAfter": {
|
||||
"Delay_2": [
|
||||
"Succeeded"
|
||||
]
|
||||
},
|
||||
"type": "Foreach",
|
||||
"runtimeConfiguration": {
|
||||
"concurrency": {
|
||||
"repetitions": 1
|
||||
}
|
||||
}
|
||||
},
|
||||
"Get_secret": {
|
||||
"runAfter": {
|
||||
"Initialize_variable_3": [
|
||||
"Succeeded"
|
||||
]
|
||||
},
|
||||
"type": "ApiConnection",
|
||||
"inputs": {
|
||||
"host": {
|
||||
"connection": {
|
||||
"name": "@parameters('$connections')['keyvault_1']['connectionId']"
|
||||
}
|
||||
},
|
||||
"method": "get",
|
||||
"path": "/secrets/@{encodeURIComponent('cloudapplist')}/value"
|
||||
}
|
||||
},
|
||||
"HTTP": {
|
||||
"runAfter": {
|
||||
"Get_secret": [
|
||||
"Succeeded"
|
||||
]
|
||||
},
|
||||
"type": "Http",
|
||||
"inputs": {
|
||||
"authentication": {
|
||||
"audience": "05a65629-4c1b-48c1-a78b-804c4abdd4af",
|
||||
"clientId": "@parameters('CloudAppAADServicePrincipal')",
|
||||
"secret": "@body('Get_secret')?['value']",
|
||||
"tenant": "@parameters('TenantID')",
|
||||
"type": "ActiveDirectoryOAuth"
|
||||
},
|
||||
"headers": {
|
||||
"Content-type ": "application-json"
|
||||
},
|
||||
"method": "GET",
|
||||
"uri": "@{parameters('MCASURL')}/api/v1/entities/"
|
||||
}
|
||||
},
|
||||
"Initialize_variable": {
|
||||
"runAfter": {
|
||||
"Condition": [
|
||||
"Succeeded"
|
||||
]
|
||||
},
|
||||
"type": "InitializeVariable",
|
||||
"inputs": {
|
||||
"variables": [
|
||||
{
|
||||
"name": "userCloudAppB64Input",
|
||||
"type": "string",
|
||||
"value": "@{null}"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"Initialize_variable_2": {
|
||||
"runAfter": {
|
||||
"Initialize_variable": [
|
||||
"Succeeded"
|
||||
]
|
||||
},
|
||||
"type": "InitializeVariable",
|
||||
"inputs": {
|
||||
"variables": [
|
||||
{
|
||||
"name": "userCloudAppB64Output",
|
||||
"type": "string",
|
||||
"value": "@{null}"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"Initialize_variable_3": {
|
||||
"runAfter": {
|
||||
"Initialize_variable_2": [
|
||||
"Succeeded"
|
||||
]
|
||||
},
|
||||
"type": "InitializeVariable",
|
||||
"inputs": {
|
||||
"variables": [
|
||||
{
|
||||
"name": "userCloudAppUrl",
|
||||
"type": "string",
|
||||
"value": "@{null}"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"Watchlists_-_Get_a_watchlist_by_alias": {
|
||||
"runAfter": {},
|
||||
"type": "ApiConnection",
|
||||
"inputs": {
|
||||
"host": {
|
||||
"connection": {
|
||||
"name": "@parameters('$connections')['azuresentinel_1']['connectionId']"
|
||||
}
|
||||
},
|
||||
"method": "get",
|
||||
"path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('SubscriptionID'))}/resourceGroups/@{encodeURIComponent(parameters('WorkspaceRGName'))}/workspaces/@{encodeURIComponent(parameters('WorkspaceID'))}/watchlists/@{encodeURIComponent('cloudappriskyusers')}"
|
||||
}
|
||||
}
|
||||
},
|
||||
"outputs": {}
|
||||
},
|
||||
"parameters": {
|
||||
"$connections": {
|
||||
"value": {
|
||||
"azuresentinel_1": {
|
||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('azuresentinelConnectionName'))]",
|
||||
"connectionName": "[variables('azuresentinelConnectionName')]",
|
||||
"connectionProperties": {
|
||||
"authentication": {
|
||||
"type": "ManagedServiceIdentity"
|
||||
}
|
||||
},
|
||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
||||
},
|
||||
"keyvault_1": {
|
||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('keyvaultConnectionName'))]",
|
||||
"connectionName": "[variables('keyvaultConnectionName')]",
|
||||
"connectionProperties": {
|
||||
"authentication": {
|
||||
"type": "ManagedServiceIdentity"
|
||||
}
|
||||
},
|
||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/keyvault')]"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
# Update-RiskyUserWatchlist
|
||||
|
||||
Author: Jhonny Paulino, Nathan Swift
|
||||
|
||||
This Logic App will run weekly and create/update a Risky User watchlist with users from Microsoft Defender for cloud app with additional data for threatscore, information, and a url.
|
||||
|
||||
**Prerequisites for the solution**:
|
||||
|
||||
1. You must create a Azure AD Service Principal, record the AppId, tenantID, and create a secrets and record the secret. This service principal will be used in the solution to query the Defender for Cloud App /entities rest api
|
||||
|
||||
2. Be sure to add the following 'Microsoft Cloud App Security' Application Permissions to the created service principal discovery.read, investigation.read . Also be sure to grant admin consent to those application permissions.
|
||||
|
||||
**Deploying the solution**:
|
||||
|
||||
1. Add/Update the missing parameters in the ARM template deployment
|
||||
The Watchlist name will be also the alias name that you will use to query the data, for example
|
||||
|
||||
_GetWatchlist(**'cloudappriskyusers'**)
|
||||
|
||||
|
||||
[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FWatchlists%2FUpdate-RiskyUserWatchlist%2Fazuredeploy.json)
|
||||
|
||||
|
||||
**Post Deployment**:
|
||||
|
||||
1. Manually check/update the Key Vault secret called 'cloudapplist' with the Azure AD Service Principal key
|
||||
|
||||
The Logic App as a Managed Service Indetity - MSI needs to have the following RBAC Roles:
|
||||
|
||||
2. Key Vault Secrets User on the deployed Key Vault resource.
|
||||
This is required for obtaining the AAD SPN secret key encrypted through Logic App.
|
||||
|
||||
3. Azure Sentinel Contributor Role on the Azure Sentinel Resource Group.
|
||||
This is required for deleting and updating the watchlist in Microsoft Sentinel.
|
||||
Загрузка…
Ссылка в новой задаче