This commit is contained in:
v-laanjana 2022-09-09 12:46:33 +05:30
Родитель 0cf3b75fe9
Коммит b1fb483b00
9 изменённых файлов: 32 добавлений и 32 удалений

Двоичные данные
Solutions/CiscoASA/Package/2.0.1.zip

Двоичный файл не отображается.

Различия файлов скрыты, потому что одна или несколько строк слишком длинны

Различия файлов скрыты, потому что одна или несколько строк слишком длинны

Просмотреть файл

@ -9,7 +9,7 @@ When a new Sentinel incident is created,this playbook gets triggered and perform
2. An adaptive card is sent to a Teams channel with information about the incident and giving the option to ignore an IP, or depdening on it's current status block it by adding it to the Network Object Group or unblock it by removing it from the Network Object Group
![Adaptive card](./images/AddIPtoNetworkObjectGroup-AdaptiveCard.png)
3. Comment is added to Microsoft sentinel incident.
3. Comment is added to Microsoft Sentinel incident.
![playbook overview](./images/AddIPtoNetworkObjectGroup-AzureSentinel-Comments.png)
**IP is added to Cisco ASA object group:**
@ -23,7 +23,7 @@ When a new Sentinel incident is created,this playbook gets triggered and perform
### Prerequisites
1. **This playbook template is based on microsoft sentinel Incident Trigger which is currently in Private Preview (Automation Rules).** You can change the trigger to the Sentinel Alert trigger in cases you are not part of the Private Preview.
1. **This playbook template is based on Microsoft Sentinel Incident Trigger which is currently in Private Preview (Automation Rules).** You can change the trigger to the Sentinel Alert trigger in cases you are not part of the Private Preview.
2. Cisco ASA custom connector needs to be deployed prior to the deployment of this playbook, in the same resource group and region. Relevant instructions can be found in the connector doc page.
3. In Cisco ASA there needs to be a Network Object Group. You can create a Network Object Group using Cisco ASDM, [Configure a Network Object Group](https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/asdm76/firewall/asdm-76-firewall-config/access-objects.html#ariaid-title6), or using the CLI, [Configuring a Network Object Group](https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/acl_objects.html#86292). The Network Object Group can be blocked using an access rule, [Configure Access Rules](https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/asdm76/firewall/asdm-76-firewall-config/access-rules.html#ID-2124-00000152)
@ -46,7 +46,7 @@ When a new Sentinel incident is created,this playbook gets triggered and perform
### Post-Deployment instructions
#### a. Authorize connections
Once deployment is complete, you will need to authorize each connection.
1. Click the microsoft sentinel connection resource
1. Click the Microsoft Sentinel connection resource
2. Click edit API connection
3. Click Authorize
4. Sign in
@ -62,5 +62,5 @@ The Teams channel to which the adaptive card will be posted will need to be conf
5. Save the Logic App
#### c. Configurations in Sentinel
1. In microsoft sentinel analytical rules should be configured to trigger an incident with IP Entity.
1. In Microsoft Sentinel analytical rules should be configured to trigger an incident with IP Entity.
2. Configure the automation rules to trigger this playbook

Различия файлов скрыты, потому что одна или несколько строк слишком длинны

Просмотреть файл

@ -8,7 +8,7 @@ When a new Sentinel incident is created, this playbook gets triggered and perfor
1. For the IPs we check if they are already directly blocked by an access control entry in the access control list
2. An adaptive card is sent to a Teams channel with information about the incident and giving the option to ignore an IP, or depdening on it's current status block it by adding an access control entry or unblock it by removing an access control entry
![Adaptive card](./images/CreateACEInACL-AdaptiveCard.png)
3. Comment is added to Microsoft sentinel incident.
3. Comment is added to Microsoft Sentinel incident.
![playbook overview](./images/CreateACEInACL-AzureSentinel-Comments.png)
**ACE is added to an ACL in Cisco ASA:**
@ -20,7 +20,7 @@ When a new Sentinel incident is created, this playbook gets triggered and perfor
### Prerequisites
1. **This playbook template is based on microsoft sentinel Incident Trigger which is currently in Private Preview (Automation Rules).** You can change the trigger to the Sentinel Alert trigger in cases you are not part of the Private Preview.
1. **This playbook template is based on Microsoft Sentinel Incident Trigger which is currently in Private Preview (Automation Rules).** You can change the trigger to the Sentinel Alert trigger in cases you are not part of the Private Preview.
2. Cisco ASA custom connector needs to be deployed prior to the deployment of this playbook, in the same resource group and region. Relevant instructions can be found in the connector doc page.
3. Cisco ASA needs to have an extended Access Control List configured. Create a new ACL or retrieve the name of an existing ACL. To use Cisco ASDM to configure Extended ACLs, see [Configure Extended ACLs](https://www.cisco.com/c/en/us/td/docs/security/asa/asa914/asdm714/firewall/asdm-714-firewall-config/access-acls.html#ID-2069-0000016d)
@ -43,7 +43,7 @@ When a new Sentinel incident is created, this playbook gets triggered and perfor
### Post-Deployment instructions
#### a. Authorize connections
Once deployment is complete, you will need to authorize each connection.
1. Click the microsoft sentinel connection resource
1. Click the Microsoft Sentinel connection resource
2. Click edit API connection
3. Click Authorize
4. Sign in
@ -59,5 +59,5 @@ The Teams channel to which the adaptive card will be posted will need to be conf
5. Save the Logic App
#### c. Configurations in Sentinel
1. In microsoft sentinel analytical rules should be configured to trigger an incident with IP Entity.
1. In Microsoft Sentinel analytical rules should be configured to trigger an incident with IP Entity.
2. Configure the automation rules to trigger this playbook

Различия файлов скрыты, потому что одна или несколько строк слишком длинны

Просмотреть файл

@ -8,7 +8,7 @@ When a new Sentinel incident is created, this playbook gets triggered and perfor
1. For the IPs we check if they are already directly blocked by an access rule on the interface
2. An adaptive card is sent to a Teams channel with information about the incident and giving the option to ignore an IP, or depdening on it's current status block it by adding an access rule or unblock it by removing an access rule
![Adaptive card](./images/CreateInboundAccessRuleOnInterface-AdaptiveCard.png)
3. Comment is added to Microsoft sentinel incident.
3. Comment is added to Microsoft Sentinel incident.
![playbook overview](./images/CreateInboundAccessRuleOnInterface-AzureSentinel-Comments.png)
**Inbound access rule is added in Cisco ASA:**
@ -20,7 +20,7 @@ When a new Sentinel incident is created, this playbook gets triggered and perfor
### Prerequisites
1. **This playbook template is based on microsoft sentinel Incident Trigger which is currently in Private Preview (Automation Rules).** You can change the trigger to the Sentinel Alert trigger in cases you are not part of the Private Preview.
1. **This playbook template is based on Microsoft Sentinel Incident Trigger which is currently in Private Preview (Automation Rules).** You can change the trigger to the Sentinel Alert trigger in cases you are not part of the Private Preview.
2. Cisco ASA custom connector needs to be deployed prior to the deployment of this playbook, in the same resource group and region. Relevant instructions can be found in the connector doc page.
3. Cisco ASA needs to have an interface configured. When enabling the interface you have to give it a name, since that is used by the API calls. To use Cisco ASDM to edit an interface, see [Enable the Physical Interface and Configure Ethernet Parameters](https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/asdm76/general/asdm-76-general-config/interface-basic.html#ariaid-title14)
@ -45,7 +45,7 @@ When a new Sentinel incident is created, this playbook gets triggered and perfor
### Post-Deployment instructions
#### a. Authorize connections
Once deployment is complete, you will need to authorize each connection.
1. Click the microsoft sentinel connection resource
1. Click the Microsoft Sentinel connection resource
2. Click edit API connection
3. Click Authorize
4. Sign in
@ -61,5 +61,5 @@ The Teams channel to which the adaptive card will be posted will need to be conf
5. Save the Logic App
#### c. Configurations in Sentinel
1. In microsoft sentinel analytical rules should be configured to trigger an incident with IP Entity.
1. In Microsoft Sentinel analytical rules should be configured to trigger an incident with IP Entity.
2. Configure the automation rules to trigger this playbook

Просмотреть файл

@ -14,7 +14,7 @@
# Overview
Cisco Adaptive Security Appliance (ASA) Software is the core operating system for the Cisco ASA Family. It delivers enterprise-class firewall capabilities for ASA devices in an array of form factors - standalone appliances, blades, and virtual appliances - for any distributed network environment. ASA Software also integrates with other critical security technologies to deliver comprehensive solutions that meet continuously evolving security needs.<br><br>
This integration allows to automate response to microsoft sentinel incidents which contain IPs. It contains the basic connector component, with which you can create your own playbooks that interact with Cisco ASA.
This integration allows to automate response to Microsoft Sentinel incidents which contain IPs. It contains the basic connector component, with which you can create your own playbooks that interact with Cisco ASA.
It also contains 3 playbook templates, ready to quick use, that allow direct response on Cisco ASA from Microsoft Teams.
<a name="prerequisites"></a>