Revert "Merge pull request #2100 from 9b/master"
This reverts commit78f3d65fe7, reversing changes made to7ab547bd60.
This commit is contained in:
Eli Forbes
Родитель
78f3d65fe7
Коммит
e3b9ec786d
|
|
@ -1,340 +0,0 @@
|
||||||
{
|
|
||||||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"metadata": {
|
|
||||||
"comments": "Automatically bring RiskIQ Intelligence into Microsoft Defender via the Microsoft Security Graph.",
|
|
||||||
"author": "Brandon Dixon, RiskIQ"
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"PlaybookName": {
|
|
||||||
"defaultValue": "Defender-Intel-Action-RiskIQ-Intel-Article-Ingest",
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"UserName": {
|
|
||||||
"defaultValue": "<username>@<domain>",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"variables": {
|
|
||||||
"MicrosoftGraphSecurityConnectionName": "[concat('microsoftgraphsecurity-', parameters('PlaybookName'))]",
|
|
||||||
"RiskIQConnectionName": "[concat('riskiqpassivetotal-', parameters('PlaybookName'))]"
|
|
||||||
},
|
|
||||||
"resources": [{
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('RiskIQConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('MicrosoftGraphSecurityConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/microsoftgraphsecurity')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Logic/workflows",
|
|
||||||
"apiVersion": "2017-07-01",
|
|
||||||
"name": "[parameters('PlaybookName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"tags": {
|
|
||||||
"LogicAppsCategory": "security"
|
|
||||||
},
|
|
||||||
"dependsOn": [
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('MicrosoftGraphSecurityConnectionName'))]"
|
|
||||||
],
|
|
||||||
"properties": {
|
|
||||||
"state": "Enabled",
|
|
||||||
"definition": {
|
|
||||||
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
|
|
||||||
"actions": {
|
|
||||||
"For_each_indicator_type": {
|
|
||||||
"actions": {
|
|
||||||
"Switch": {
|
|
||||||
"cases": {
|
|
||||||
"Domain_Case": {
|
|
||||||
"actions": {
|
|
||||||
"For_each_domain": {
|
|
||||||
"actions": {
|
|
||||||
"Append_to_domains": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "domains",
|
|
||||||
"value": {
|
|
||||||
"action": "alert",
|
|
||||||
"additionalInformation": "@body('Get_article_details')?['link']",
|
|
||||||
"description": "@body('Get_article_details')?['title']",
|
|
||||||
"domainName": "@items('For_each_domain')",
|
|
||||||
"expirationDateTime": "@addDays(utcNow(), 30)",
|
|
||||||
"targetProduct": "Microsoft Defender ATP",
|
|
||||||
"threatType": "WatchList",
|
|
||||||
"tlpLevel": "green"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "AppendToArrayVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@items('For_each_indicator_type')?['values']",
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Submit_multiple_domain_tiIndicators": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"value": "@variables('domains')"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['microsoftgraphsecurity']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/beta/security/tiIndicators/submitTiIndicators"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"For_each_domain": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"case": "domain"
|
|
||||||
},
|
|
||||||
"IP_Case": {
|
|
||||||
"actions": {
|
|
||||||
"For_each_ip": {
|
|
||||||
"actions": {
|
|
||||||
"Append_to_ip_addresses": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "ip",
|
|
||||||
"value": {
|
|
||||||
"action": "alert",
|
|
||||||
"additionalInformation": "@body('Get_article_details')?['link']",
|
|
||||||
"description": "@body('Get_article_details')?['title']",
|
|
||||||
"expirationDateTime": "@addDays(utcNow(), 30)",
|
|
||||||
"networkDestinationIPv4": "@items('For_each_ip')",
|
|
||||||
"targetProduct": "Microsoft Defender ATP",
|
|
||||||
"threatType": "WatchList",
|
|
||||||
"tlpLevel": "green"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "AppendToArrayVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@items('For_each_indicator_type')?['values']",
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Submit_multiple_ip_tiIndicators": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"value": "@variables('ip')"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['microsoftgraphsecurity']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/beta/security/tiIndicators/submitTiIndicators"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"For_each_ip": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"case": "ip"
|
|
||||||
},
|
|
||||||
"URLs_Case": {
|
|
||||||
"actions": {
|
|
||||||
"For_each_url": {
|
|
||||||
"actions": {
|
|
||||||
"Append_to_urls": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "urls",
|
|
||||||
"value": {
|
|
||||||
"action": "alert",
|
|
||||||
"additionalInformation": "@body('Get_article_details')?['link']",
|
|
||||||
"description": "@body('Get_article_details')?['title']",
|
|
||||||
"expirationDateTime": "@addDays(utcNow(), 30)",
|
|
||||||
"targetProduct": "Microsoft Defender ATP",
|
|
||||||
"threatType": "WatchList",
|
|
||||||
"tlpLevel": "green",
|
|
||||||
"url": "@items('For_each_url')"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "AppendToArrayVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@items('For_each_indicator_type')?['values']",
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Submit_multiple_url_tiIndicators": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"value": "@variables('urls')"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['microsoftgraphsecurity']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/beta/security/tiIndicators/submitTiIndicators"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"For_each_url": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"case": "url"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"default": {
|
|
||||||
"actions": {}
|
|
||||||
},
|
|
||||||
"expression": "@items('For_each_indicator_type')?['type']",
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "Switch"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Get_article_details')?['indicators']",
|
|
||||||
"runAfter": {
|
|
||||||
"Init_domains": [
|
|
||||||
"Succeeded"
|
|
||||||
],
|
|
||||||
"Init_ip_addresses": [
|
|
||||||
"Succeeded"
|
|
||||||
],
|
|
||||||
"Init_urls": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Get_article_details": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/articles/@{encodeURIComponent(triggerBody()?['guid'])}"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Init_domains": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "domains",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Get_article_details": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
},
|
|
||||||
"Init_ip_addresses": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "ip",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Get_article_details": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
},
|
|
||||||
"Init_urls": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "urls",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Get_article_details": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"outputs": {},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"defaultValue": {},
|
|
||||||
"type": "Object"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"triggers": {
|
|
||||||
"manual": {
|
|
||||||
"inputs": {
|
|
||||||
"schema": {
|
|
||||||
"properties": {
|
|
||||||
"guid": {
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"type": "object"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"kind": "Http",
|
|
||||||
"type": "Request"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"value": {
|
|
||||||
"microsoftgraphsecurity": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('MicrosoftGraphSecurityConnectionName'))]",
|
|
||||||
"connectionName": "[variables('MicrosoftGraphSecurityConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/microsoftgraphsecurity')]"
|
|
||||||
},
|
|
||||||
"riskiqpassivetotal": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"connectionName": "[variables('RiskIQConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}]
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
# Defender-Intel-Action-RiskIQ-Intel-Article-Ingest
|
|
||||||
author: Brandon Dixon, RiskIQ
|
|
||||||
|
|
||||||
This playbook will populate the Microsoft Security Graph for Microsoft Defender with indicators from RiskIQ articles. You need a valid community or enterprise in order to use the connector and playbook. To learn more about the service and request a trial key, [register for free](https://community.riskiq.com/) or see the [API documentation](https://api.passivetotal.org/index.html).
|
|
||||||
|
|
||||||
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FDefender-Intel-Action-RiskIQ-Intel-Article-Ingest%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://aka.ms/deploytoazurebutton"/>
|
|
||||||
</a>
|
|
||||||
<a href="https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FDefender-Intel-Action-RiskIQ-Intel-Article-Ingest%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazuregov.png"/>
|
|
||||||
</a>
|
|
||||||
|
|
@ -1,473 +0,0 @@
|
||||||
{
|
|
||||||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"metadata": {
|
|
||||||
"comments": "Perform automated actions on the Azure Sentinels Incident based on RiskIQ Reputation data.",
|
|
||||||
"author": "Brandon Dixon, RiskIQ"
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"PlaybookName": {
|
|
||||||
"defaultValue": "Sentinel-Incident-Action-RiskIQ-Reputation-All",
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"UserName": {
|
|
||||||
"defaultValue": "<username>@<domain>",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"variables": {
|
|
||||||
"AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]",
|
|
||||||
"RiskIQConnectionName": "[concat('riskiqpassivetotal-', parameters('PlaybookName'))]"
|
|
||||||
},
|
|
||||||
"resources": [{
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('RiskIQConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Logic/workflows",
|
|
||||||
"apiVersion": "2017-07-01",
|
|
||||||
"name": "[parameters('PlaybookName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"tags": {
|
|
||||||
"LogicAppsCategory": "security"
|
|
||||||
},
|
|
||||||
"dependsOn": [
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]"
|
|
||||||
],
|
|
||||||
"properties": {
|
|
||||||
"state": "Enabled",
|
|
||||||
"definition": {
|
|
||||||
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
|
|
||||||
"actions": {
|
|
||||||
"Alert_-_Get_incident": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/Incidents/subscriptions/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/resourceGroups/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/workspaces/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/alerts/@{encodeURIComponent(triggerBody()?['SystemAlertId'])}"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_Hosts": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/host"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Classification_Bit": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_IPs": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/ip"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Classification_Bit": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"For_each_Host": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>RiskIQ Reputation: @{items('For_each_Host')?['HostName']}.@{items('For_each_Host')?['DnsDomain']}<br>\nClassification: @{body('Get_reputation_for_host')?['classification']} (@{body('Get_reputation_for_host')?['score']})<br>\n@{body('Create_Host_HTML_table')}</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Create_Host_HTML_table": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Append_host_classification": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "classification_bit",
|
|
||||||
"value": "@body('Get_reputation_for_host')?['classification']"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Set_host_variable": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "AppendToArrayVariable"
|
|
||||||
},
|
|
||||||
"Create_Host_HTML_table": {
|
|
||||||
"inputs": {
|
|
||||||
"format": "HTML",
|
|
||||||
"from": "@variables('result_output_host')"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Append_host_classification": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Table"
|
|
||||||
},
|
|
||||||
"Get_reputation_for_host": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/reputation",
|
|
||||||
"queries": {
|
|
||||||
"query": "@{items('For_each_Host')?['HostName']}.@{items('For_each_Host')?['DnsDomain']}"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Set_host_variable": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "result_output_host",
|
|
||||||
"value": "@body('Get_reputation_for_host')?['rules']"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Get_reputation_for_host": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "SetVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_Hosts')?['Hosts']",
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Result_Host": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"For_each_IP_Address": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)_2": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>RiskIQ Reputation: @{items('For_each_IP_Address')?['Address']}<br>\nClassification: @{body('Get_reputation')?['classification']} (@{body('Get_reputation')?['score']})<br>\n@{body('Create_IP_HTML_table')}</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Create_IP_HTML_table": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Append_ip_classification": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "classification_bit",
|
|
||||||
"value": "@body('Get_reputation')?['classification']"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Set_ip_variable": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "AppendToArrayVariable"
|
|
||||||
},
|
|
||||||
"Create_IP_HTML_table": {
|
|
||||||
"inputs": {
|
|
||||||
"format": "HTML",
|
|
||||||
"from": "@variables('result_output_ip')"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Append_ip_classification": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Table"
|
|
||||||
},
|
|
||||||
"Get_reputation": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/reputation",
|
|
||||||
"queries": {
|
|
||||||
"query": "@items('For_each_IP_Address')?['Address']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Set_ip_variable": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "result_output_ip",
|
|
||||||
"value": "@body('Get_reputation')?['rules']"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Get_reputation": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "SetVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_IPs')?['IPs']",
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Result_IP": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Init_Classification_Bit": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "classification_bit",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Alert_-_Get_incident": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
},
|
|
||||||
"Init_Result_Host": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "result_output_host",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_Hosts": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
},
|
|
||||||
"Init_Result_IP": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "result_output_ip",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_IPs": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
},
|
|
||||||
"Malicious_or_Suspicious": {
|
|
||||||
"actions": {
|
|
||||||
"Condition_2": {
|
|
||||||
"actions": {
|
|
||||||
"Update_incident": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"owner": "@body('Alert_-_Get_incident')?['properties']?['owner']?['objectId']",
|
|
||||||
"ownerAction": "Unassign",
|
|
||||||
"severity": "High",
|
|
||||||
"status": "Active",
|
|
||||||
"tagsToAdd": {
|
|
||||||
"TagsToAdd": [
|
|
||||||
{
|
|
||||||
"Tag": "RiskIQ Malicious"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "put",
|
|
||||||
"path": "/Incidents"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"else": {
|
|
||||||
"actions": {
|
|
||||||
"Update_incident_2": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"owner": "@body('Alert_-_Get_incident')?['properties']?['owner']?['objectId']",
|
|
||||||
"ownerAction": "Unassign",
|
|
||||||
"severity": "Medium",
|
|
||||||
"status": "Active",
|
|
||||||
"tagsToAdd": {
|
|
||||||
"TagsToAdd": [
|
|
||||||
{
|
|
||||||
"Tag": "RiskIQ Suspicious"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "put",
|
|
||||||
"path": "/Incidents"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"expression": {
|
|
||||||
"and": [
|
|
||||||
{
|
|
||||||
"contains": [
|
|
||||||
"@variables('classification_bit')",
|
|
||||||
"MALICIOUS"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "If"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"expression": {
|
|
||||||
"or": [
|
|
||||||
{
|
|
||||||
"contains": [
|
|
||||||
"@variables('classification_bit')",
|
|
||||||
"MALICIOUS"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"contains": [
|
|
||||||
"@variables('classification_bit')",
|
|
||||||
"SUSPICIOUS"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"For_each_Host": [
|
|
||||||
"Succeeded"
|
|
||||||
],
|
|
||||||
"For_each_IP_Address": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "If"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"outputs": {},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"defaultValue": {},
|
|
||||||
"type": "Object"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"triggers": {
|
|
||||||
"When_a_response_to_an_Azure_Sentinel_alert_is_triggered": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"callback_url": "@{listCallbackUrl()}"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"path": "/subscribe"
|
|
||||||
},
|
|
||||||
"type": "ApiConnectionWebhook"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"value": {
|
|
||||||
"azuresentinel": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]",
|
|
||||||
"connectionName": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
},
|
|
||||||
"riskiqpassivetotal": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"connectionName": "[variables('RiskIQConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}]
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
# Sentinel-Incident-Action-RiskIQ-Reputation-All
|
|
||||||
author: Brandon Dixon, RiskIQ
|
|
||||||
|
|
||||||
This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Azure Sentinel. You need a valid community or enterprise in order to use the connector and playbook. To learn more about the service and request a trial key, [register for free](https://community.riskiq.com/) or see the [API documentation](https://api.passivetotal.org/index.html).
|
|
||||||
|
|
||||||
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Action-RiskIQ-Reputation-All%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://aka.ms/deploytoazurebutton"/>
|
|
||||||
</a>
|
|
||||||
<a href="https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Action-RiskIQ-Reputation-All%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazuregov.png"/>
|
|
||||||
</a>
|
|
||||||
|
|
@ -1,352 +0,0 @@
|
||||||
{
|
|
||||||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"metadata": {
|
|
||||||
"comments": "Perform automated actions on the Azure Sentinel Incidents based on RiskIQ Reputation data.",
|
|
||||||
"author": "Brandon Dixon, RiskIQ"
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"PlaybookName": {
|
|
||||||
"defaultValue": "Sentinel-Incident-Action-RiskIQ-Reputation-Domain",
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"UserName": {
|
|
||||||
"defaultValue": "<username>@<domain>",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"variables": {
|
|
||||||
"AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]",
|
|
||||||
"RiskIQConnectionName": "[concat('riskiqpassivetotal-', parameters('PlaybookName'))]"
|
|
||||||
},
|
|
||||||
"resources": [{
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('RiskIQConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Logic/workflows",
|
|
||||||
"apiVersion": "2017-07-01",
|
|
||||||
"name": "[parameters('PlaybookName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"tags": {
|
|
||||||
"LogicAppsCategory": "security"
|
|
||||||
},
|
|
||||||
"dependsOn": [
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]"
|
|
||||||
],
|
|
||||||
"properties": {
|
|
||||||
"state": "Enabled",
|
|
||||||
"definition": {
|
|
||||||
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
|
|
||||||
"actions": {
|
|
||||||
"Alert_-_Get_incident": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/Incidents/subscriptions/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/resourceGroups/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/workspaces/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/alerts/@{encodeURIComponent(triggerBody()?['SystemAlertId'])}"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_Hosts": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/host"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Classification_Bit": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"For_each_Host": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>RiskIQ Reputation: @{items('For_each_Host')?['HostName']}.@{items('For_each_Host')?['DnsDomain']}<br>\nClassification: @{body('Get_reputation_for_host')?['classification']} (@{body('Get_reputation_for_host')?['score']})<br>\n@{body('Create_Host_HTML_table')}</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Create_Host_HTML_table": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Append_host_classification": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "classification_bit",
|
|
||||||
"value": "@body('Get_reputation_for_host')?['classification']"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Set_host_variable": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "AppendToArrayVariable"
|
|
||||||
},
|
|
||||||
"Create_Host_HTML_table": {
|
|
||||||
"inputs": {
|
|
||||||
"format": "HTML",
|
|
||||||
"from": "@variables('result_output_host')"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Append_host_classification": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Table"
|
|
||||||
},
|
|
||||||
"Get_reputation_for_host": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/reputation",
|
|
||||||
"queries": {
|
|
||||||
"query": "@{items('For_each_Host')?['HostName']}.@{items('For_each_Host')?['DnsDomain']}"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Set_host_variable": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "result_output_host",
|
|
||||||
"value": "@body('Get_reputation_for_host')?['rules']"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Get_reputation_for_host": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "SetVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_Hosts')?['Hosts']",
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Result_Host": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Init_Classification_Bit": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "classification_bit",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Alert_-_Get_incident": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
},
|
|
||||||
"Init_Result_Host": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "result_output_host",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_Hosts": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
},
|
|
||||||
"Malicious_or_Suspicious": {
|
|
||||||
"actions": {
|
|
||||||
"Condition_2": {
|
|
||||||
"actions": {
|
|
||||||
"Update_incident": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"owner": "@body('Alert_-_Get_incident')?['properties']?['owner']?['objectId']",
|
|
||||||
"ownerAction": "Unassign",
|
|
||||||
"severity": "High",
|
|
||||||
"status": "Active",
|
|
||||||
"tagsToAdd": {
|
|
||||||
"TagsToAdd": [
|
|
||||||
{
|
|
||||||
"Tag": "RiskIQ Malicious"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "put",
|
|
||||||
"path": "/Incidents"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"else": {
|
|
||||||
"actions": {
|
|
||||||
"Update_incident_2": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"owner": "@body('Alert_-_Get_incident')?['properties']?['owner']?['objectId']",
|
|
||||||
"ownerAction": "Unassign",
|
|
||||||
"severity": "Medium",
|
|
||||||
"status": "Active",
|
|
||||||
"tagsToAdd": {
|
|
||||||
"TagsToAdd": [
|
|
||||||
{
|
|
||||||
"Tag": "RiskIQ Suspicious"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "put",
|
|
||||||
"path": "/Incidents"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"expression": {
|
|
||||||
"and": [
|
|
||||||
{
|
|
||||||
"contains": [
|
|
||||||
"@variables('classification_bit')",
|
|
||||||
"MALICIOUS"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "If"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"expression": {
|
|
||||||
"or": [
|
|
||||||
{
|
|
||||||
"contains": [
|
|
||||||
"@variables('classification_bit')",
|
|
||||||
"MALICIOUS"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"contains": [
|
|
||||||
"@variables('classification_bit')",
|
|
||||||
"SUSPICIOUS"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"For_each_Host": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "If"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"outputs": {},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"defaultValue": {},
|
|
||||||
"type": "Object"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"triggers": {
|
|
||||||
"When_a_response_to_an_Azure_Sentinel_alert_is_triggered": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"callback_url": "@{listCallbackUrl()}"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"path": "/subscribe"
|
|
||||||
},
|
|
||||||
"type": "ApiConnectionWebhook"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"value": {
|
|
||||||
"azuresentinel": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]",
|
|
||||||
"connectionName": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
},
|
|
||||||
"riskiqpassivetotal": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"connectionName": "[variables('RiskIQConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}]
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
# Sentinel-Incident-Action-RiskIQ-Reputation-Domain
|
|
||||||
author: Brandon Dixon, RiskIQ
|
|
||||||
|
|
||||||
This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Azure Sentinel. You need a valid community or enterprise in order to use the connector and playbook. To learn more about the service and request a trial key, [register for free](https://community.riskiq.com/) or see the [API documentation](https://api.passivetotal.org/index.html).
|
|
||||||
|
|
||||||
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Action-RiskIQ-Reputation-Domain%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://aka.ms/deploytoazurebutton"/>
|
|
||||||
</a>
|
|
||||||
<a href="https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Action-RiskIQ-Reputation-Domain%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazuregov.png"/>
|
|
||||||
</a>
|
|
||||||
|
|
@ -1,352 +0,0 @@
|
||||||
{
|
|
||||||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"metadata": {
|
|
||||||
"comments": "Perform automated actions on the Azure Sentinel Incidents based on RiskIQ Reputation data.",
|
|
||||||
"author": "Brandon Dixon, RiskIQ"
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"PlaybookName": {
|
|
||||||
"defaultValue": "Sentinel-Incident-Action-RiskIQ-Reputation-IP",
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"UserName": {
|
|
||||||
"defaultValue": "<username>@<domain>",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"variables": {
|
|
||||||
"AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]",
|
|
||||||
"RiskIQConnectionName": "[concat('riskiqpassivetotal-', parameters('PlaybookName'))]"
|
|
||||||
},
|
|
||||||
"resources": [{
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('RiskIQConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Logic/workflows",
|
|
||||||
"apiVersion": "2017-07-01",
|
|
||||||
"name": "[parameters('PlaybookName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"tags": {
|
|
||||||
"LogicAppsCategory": "security"
|
|
||||||
},
|
|
||||||
"dependsOn": [
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]"
|
|
||||||
],
|
|
||||||
"properties": {
|
|
||||||
"state": "Enabled",
|
|
||||||
"definition": {
|
|
||||||
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
|
|
||||||
"actions": {
|
|
||||||
"Alert_-_Get_incident": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/Incidents/subscriptions/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/resourceGroups/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/workspaces/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/alerts/@{encodeURIComponent(triggerBody()?['SystemAlertId'])}"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_IPs": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/ip"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Classification_Bit": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"For_each_IP_Address": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)_2": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>RiskIQ Reputation: @{items('For_each_IP_Address')?['Address']}<br>\nClassification: @{body('Get_reputation')?['classification']} (@{body('Get_reputation')?['score']})<br>\n@{body('Create_IP_HTML_table')}</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Create_IP_HTML_table": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Append_ip_classification": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "classification_bit",
|
|
||||||
"value": "@body('Get_reputation')?['classification']"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Set_ip_variable": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "AppendToArrayVariable"
|
|
||||||
},
|
|
||||||
"Create_IP_HTML_table": {
|
|
||||||
"inputs": {
|
|
||||||
"format": "HTML",
|
|
||||||
"from": "@variables('result_output_ip')"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Append_ip_classification": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Table"
|
|
||||||
},
|
|
||||||
"Get_reputation": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/reputation",
|
|
||||||
"queries": {
|
|
||||||
"query": "@items('For_each_IP_Address')?['Address']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Set_ip_variable": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "result_output_ip",
|
|
||||||
"value": "@body('Get_reputation')?['rules']"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Get_reputation": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "SetVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_IPs')?['IPs']",
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Result_IP": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Init_Classification_Bit": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "classification_bit",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Alert_-_Get_incident": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
},
|
|
||||||
"Init_Result_IP": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "result_output_ip",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_IPs": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
},
|
|
||||||
"Malicious_or_Suspicious": {
|
|
||||||
"actions": {
|
|
||||||
"Condition_2": {
|
|
||||||
"actions": {
|
|
||||||
"Update_incident": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"owner": "@body('Alert_-_Get_incident')?['properties']?['owner']?['objectId']",
|
|
||||||
"ownerAction": "Unassign",
|
|
||||||
"severity": "High",
|
|
||||||
"status": "Active",
|
|
||||||
"tagsToAdd": {
|
|
||||||
"TagsToAdd": [
|
|
||||||
{
|
|
||||||
"Tag": "RiskIQ Malicious"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "put",
|
|
||||||
"path": "/Incidents"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"else": {
|
|
||||||
"actions": {
|
|
||||||
"Update_incident_2": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"owner": "@body('Alert_-_Get_incident')?['properties']?['owner']?['objectId']",
|
|
||||||
"ownerAction": "Unassign",
|
|
||||||
"severity": "Medium",
|
|
||||||
"status": "Active",
|
|
||||||
"tagsToAdd": {
|
|
||||||
"TagsToAdd": [
|
|
||||||
{
|
|
||||||
"Tag": "RiskIQ Suspicious"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "put",
|
|
||||||
"path": "/Incidents"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"expression": {
|
|
||||||
"and": [
|
|
||||||
{
|
|
||||||
"contains": [
|
|
||||||
"@variables('classification_bit')",
|
|
||||||
"MALICIOUS"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "If"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"expression": {
|
|
||||||
"or": [
|
|
||||||
{
|
|
||||||
"contains": [
|
|
||||||
"@variables('classification_bit')",
|
|
||||||
"MALICIOUS"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"contains": [
|
|
||||||
"@variables('classification_bit')",
|
|
||||||
"SUSPICIOUS"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"For_each_IP_Address": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "If"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"outputs": {},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"defaultValue": {},
|
|
||||||
"type": "Object"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"triggers": {
|
|
||||||
"When_a_response_to_an_Azure_Sentinel_alert_is_triggered": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"callback_url": "@{listCallbackUrl()}"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"path": "/subscribe"
|
|
||||||
},
|
|
||||||
"type": "ApiConnectionWebhook"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"value": {
|
|
||||||
"azuresentinel": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]",
|
|
||||||
"connectionName": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
},
|
|
||||||
"riskiqpassivetotal": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"connectionName": "[variables('RiskIQConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}]
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
# Sentinel-Incident-Action-RiskIQ-Reputation-IP
|
|
||||||
author: Brandon Dixon, RiskIQ
|
|
||||||
|
|
||||||
This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Azure Sentinel. You need a valid community or enterprise in order to use the connector and playbook. To learn more about the service and request a trial key, [register for free](https://community.riskiq.com/) or see the [API documentation](https://api.passivetotal.org/index.html).
|
|
||||||
|
|
||||||
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Action-RiskIQ-Reputation-IP%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://aka.ms/deploytoazurebutton"/>
|
|
||||||
</a>
|
|
||||||
<a href="https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Action-RiskIQ-Reputation-IP%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazuregov.png"/>
|
|
||||||
</a>
|
|
||||||
|
|
@ -1,487 +0,0 @@
|
||||||
{
|
|
||||||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"metadata": {
|
|
||||||
"comments": "Perform automated enrichment on the Azure Sentinel Incidents based on RiskIQ Internet data.",
|
|
||||||
"author": "Brandon Dixon, RiskIQ"
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"PlaybookName": {
|
|
||||||
"defaultValue": "Sentinel-Incident-Enrich-RiskIQ-Data-PassiveDns-All",
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"UserName": {
|
|
||||||
"defaultValue": "<username>@<domain>",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"variables": {
|
|
||||||
"AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]",
|
|
||||||
"RiskIQConnectionName": "[concat('riskiqpassivetotal-', parameters('PlaybookName'))]"
|
|
||||||
},
|
|
||||||
"resources": [{
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('RiskIQConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Logic/workflows",
|
|
||||||
"apiVersion": "2017-07-01",
|
|
||||||
"name": "[parameters('PlaybookName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"tags": {
|
|
||||||
"LogicAppsCategory": "security"
|
|
||||||
},
|
|
||||||
"dependsOn": [
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]"
|
|
||||||
],
|
|
||||||
"properties": {
|
|
||||||
"state": "Enabled",
|
|
||||||
"definition": {
|
|
||||||
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
|
|
||||||
"actions": {
|
|
||||||
"Alert_-_Get_incident": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/Incidents/subscriptions/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/resourceGroups/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/workspaces/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/alerts/@{encodeURIComponent(triggerBody()?['SystemAlertId'])}"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_Hosts": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/host"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Lookback_Period": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_IPs": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/ip"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Lookback_Period": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"For_each_host": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>Last week of Passive DNS for @{items('For_each_host')?['HostName']}.@{items('For_each_host')?['DnsDomain']}<br>\n@{variables('domain_comment')}</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Condition": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Condition": {
|
|
||||||
"actions": {
|
|
||||||
"Create_Host_HTML_table": {
|
|
||||||
"inputs": {
|
|
||||||
"format": "HTML",
|
|
||||||
"from": "@variables('domain_results')"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "Table"
|
|
||||||
},
|
|
||||||
"Set_domain_comment": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "domain_comment",
|
|
||||||
"value": "@body('Create_Host_HTML_table')"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Create_Host_HTML_table": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "SetVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"else": {
|
|
||||||
"actions": {
|
|
||||||
"Set_domain_comment_empty": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "domain_comment",
|
|
||||||
"value": "No results found."
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "SetVariable"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"expression": {
|
|
||||||
"and": [
|
|
||||||
{
|
|
||||||
"greater": [
|
|
||||||
"@length(variables('domain_results'))",
|
|
||||||
0
|
|
||||||
]
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"For_each_host_resolve": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "If"
|
|
||||||
},
|
|
||||||
"For_each_host_resolve": {
|
|
||||||
"actions": {
|
|
||||||
"Append_to_array_variable": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "domain_results",
|
|
||||||
"value": {
|
|
||||||
"First": "@body('Get_passive_DNS')?['firstSeen']",
|
|
||||||
"Last": "@body('Get_passive_DNS')?['lastSeen']",
|
|
||||||
"Type": "@items('For_each_host_resolve')?['recordType']",
|
|
||||||
"Value": "@items('For_each_host_resolve')?['resolve']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "AppendToArrayVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Get_passive_DNS')?['results']",
|
|
||||||
"runAfter": {
|
|
||||||
"Get_passive_DNS": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Get_passive_DNS": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/dns/passive",
|
|
||||||
"queries": {
|
|
||||||
"query": "@{items('For_each_host')?['HostName']}.@{items('For_each_host')?['DnsDomain']}",
|
|
||||||
"start": "@variables('lookback')",
|
|
||||||
"timeout": 7
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_Hosts')?['Hosts']",
|
|
||||||
"runAfter": {
|
|
||||||
"Init_domain_comment": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"For_each_ip": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)_2": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>Last week of Passive DNS for @{items('For_each_ip')?['Address']}<br>\n@{variables('ip_comment')}</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Condition_2": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Condition_2": {
|
|
||||||
"actions": {
|
|
||||||
"Create_IP_HTML_table": {
|
|
||||||
"inputs": {
|
|
||||||
"format": "HTML",
|
|
||||||
"from": "@variables('ip_results')"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "Table"
|
|
||||||
},
|
|
||||||
"Set_ip_comment": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "ip_comment",
|
|
||||||
"value": "@body('Create_IP_HTML_table')"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Create_IP_HTML_table": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "SetVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"else": {
|
|
||||||
"actions": {
|
|
||||||
"Set_variable": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "ip_comment",
|
|
||||||
"value": "No results found."
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "SetVariable"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"expression": {
|
|
||||||
"and": [
|
|
||||||
{
|
|
||||||
"greater": [
|
|
||||||
"@length(variables('ip_results'))",
|
|
||||||
0
|
|
||||||
]
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"For_each_ip_resolve": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "If"
|
|
||||||
},
|
|
||||||
"For_each_ip_resolve": {
|
|
||||||
"actions": {
|
|
||||||
"Append_to_array_variable_2": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "ip_results",
|
|
||||||
"value": {
|
|
||||||
"First": "@item()?['firstSeen']",
|
|
||||||
"Last": "@item()?['lastSeen']",
|
|
||||||
"Type": "@items('For_each_ip_resolve')?['recordType']",
|
|
||||||
"Value": "@items('For_each_ip_resolve')?['resolve']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "AppendToArrayVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Get_passive_DNS_2')?['results']",
|
|
||||||
"runAfter": {
|
|
||||||
"Get_passive_DNS_2": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Get_passive_DNS_2": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/dns/passive",
|
|
||||||
"queries": {
|
|
||||||
"query": "@items('For_each_ip')?['Address']",
|
|
||||||
"start": "@variables('lookback')",
|
|
||||||
"timeout": 7
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_IPs')?['IPs']",
|
|
||||||
"runAfter": {
|
|
||||||
"Init_ip_comment": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Init_Lookback_Period": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "lookback",
|
|
||||||
"type": "string",
|
|
||||||
"value": "@{formatDateTime(addDays(utcNow(), -7), 'yyyy-MM-dd')}"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Alert_-_Get_incident": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
},
|
|
||||||
"Init_domain_comment": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "domain_comment",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Init_domain_results": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
},
|
|
||||||
"Init_domain_results": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "domain_results",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_Hosts": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
},
|
|
||||||
"Init_ip_comment": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "ip_comment",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Init_ip_results": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
},
|
|
||||||
"Init_ip_results": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "ip_results",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_IPs": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"outputs": {},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"defaultValue": {},
|
|
||||||
"type": "Object"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"triggers": {
|
|
||||||
"When_a_response_to_an_Azure_Sentinel_alert_is_triggered": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"callback_url": "@{listCallbackUrl()}"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"path": "/subscribe"
|
|
||||||
},
|
|
||||||
"type": "ApiConnectionWebhook"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"value": {
|
|
||||||
"azuresentinel": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]",
|
|
||||||
"connectionName": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
},
|
|
||||||
"riskiqpassivetotal": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"connectionName": "[variables('RiskIQConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}]
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
# Sentinel-Incident-Enrich-RiskIQ-Data-PassiveDns-All
|
|
||||||
author: Brandon Dixon, RiskIQ
|
|
||||||
|
|
||||||
This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Azure Sentinel. You need a valid community or enterprise in order to use the connector and playbook. To learn more about the service and request a trial key, [register for free](https://community.riskiq.com/) or see the [API documentation](https://api.passivetotal.org/index.html).
|
|
||||||
|
|
||||||
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Data-PassiveDns-All%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://aka.ms/deploytoazurebutton"/>
|
|
||||||
</a>
|
|
||||||
<a href="https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Data-PassiveDns-All%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazuregov.png"/>
|
|
||||||
</a>
|
|
||||||
|
|
@ -1,311 +0,0 @@
|
||||||
{
|
|
||||||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"metadata": {
|
|
||||||
"comments": "Perform automated enrichment on the Azure Sentinel Incidents based on RiskIQ Internet data.",
|
|
||||||
"author": "Brandon Dixon, RiskIQ"
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"PlaybookName": {
|
|
||||||
"defaultValue": "Sentinel-Incident-Enrich-RiskIQ-Data-PassiveDns-Domain",
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"UserName": {
|
|
||||||
"defaultValue": "<username>@<domain>",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"variables": {
|
|
||||||
"AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]",
|
|
||||||
"RiskIQConnectionName": "[concat('riskiqpassivetotal-', parameters('PlaybookName'))]"
|
|
||||||
},
|
|
||||||
"resources": [{
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('RiskIQConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Logic/workflows",
|
|
||||||
"apiVersion": "2017-07-01",
|
|
||||||
"name": "[parameters('PlaybookName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"tags": {
|
|
||||||
"LogicAppsCategory": "security"
|
|
||||||
},
|
|
||||||
"dependsOn": [
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]"
|
|
||||||
],
|
|
||||||
"properties": {
|
|
||||||
"state": "Enabled",
|
|
||||||
"definition": {
|
|
||||||
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
|
|
||||||
"actions": {
|
|
||||||
"Alert_-_Get_incident": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/Incidents/subscriptions/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/resourceGroups/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/workspaces/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/alerts/@{encodeURIComponent(triggerBody()?['SystemAlertId'])}"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_Hosts": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/host"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Lookback_Period": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"For_each_host": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>Last week of Passive DNS for @{items('For_each_host')?['HostName']}.@{items('For_each_host')?['DnsDomain']}<br>\n@{variables('domain_comment')}</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Condition": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Condition": {
|
|
||||||
"actions": {
|
|
||||||
"Create_Host_HTML_table": {
|
|
||||||
"inputs": {
|
|
||||||
"format": "HTML",
|
|
||||||
"from": "@variables('domain_results')"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "Table"
|
|
||||||
},
|
|
||||||
"Set_domain_comment": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "domain_comment",
|
|
||||||
"value": "@body('Create_Host_HTML_table')"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Create_Host_HTML_table": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "SetVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"else": {
|
|
||||||
"actions": {
|
|
||||||
"Set_domain_comment_empty": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "domain_comment",
|
|
||||||
"value": "No results found."
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "SetVariable"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"expression": {
|
|
||||||
"and": [
|
|
||||||
{
|
|
||||||
"greater": [
|
|
||||||
"@length(variables('domain_results'))",
|
|
||||||
0
|
|
||||||
]
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"For_each_host_resolve": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "If"
|
|
||||||
},
|
|
||||||
"For_each_host_resolve": {
|
|
||||||
"actions": {
|
|
||||||
"Append_to_array_variable": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "domain_results",
|
|
||||||
"value": {
|
|
||||||
"First": "@body('Get_passive_DNS')?['firstSeen']",
|
|
||||||
"Last": "@body('Get_passive_DNS')?['lastSeen']",
|
|
||||||
"Type": "@items('For_each_host_resolve')?['recordType']",
|
|
||||||
"Value": "@items('For_each_host_resolve')?['resolve']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "AppendToArrayVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Get_passive_DNS')?['results']",
|
|
||||||
"runAfter": {
|
|
||||||
"Get_passive_DNS": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Get_passive_DNS": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/dns/passive",
|
|
||||||
"queries": {
|
|
||||||
"query": "@{items('For_each_host')?['HostName']}.@{items('For_each_host')?['DnsDomain']}",
|
|
||||||
"start": "@variables('lookback')",
|
|
||||||
"timeout": 7
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_Hosts')?['Hosts']",
|
|
||||||
"runAfter": {
|
|
||||||
"Init_domain_comment": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Init_Lookback_Period": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "lookback",
|
|
||||||
"type": "string",
|
|
||||||
"value": "@{formatDateTime(addDays(utcNow(), -7), 'yyyy-MM-dd')}"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Alert_-_Get_incident": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
},
|
|
||||||
"Init_domain_comment": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "domain_comment",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Init_domain_results": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
},
|
|
||||||
"Init_domain_results": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "domain_results",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_Hosts": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"outputs": {},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"defaultValue": {},
|
|
||||||
"type": "Object"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"triggers": {
|
|
||||||
"When_a_response_to_an_Azure_Sentinel_alert_is_triggered": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"callback_url": "@{listCallbackUrl()}"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"path": "/subscribe"
|
|
||||||
},
|
|
||||||
"type": "ApiConnectionWebhook"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"value": {
|
|
||||||
"azuresentinel": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]",
|
|
||||||
"connectionName": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
},
|
|
||||||
"riskiqpassivetotal": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"connectionName": "[variables('RiskIQConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}]
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
# Sentinel-Incident-Enrich-RiskIQ-Data-PassiveDns-Domain
|
|
||||||
author: Brandon Dixon, RiskIQ
|
|
||||||
|
|
||||||
This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Azure Sentinel. You need a valid community or enterprise in order to use the connector and playbook. To learn more about the service and request a trial key, [register for free](https://community.riskiq.com/) or see the [API documentation](https://api.passivetotal.org/index.html).
|
|
||||||
|
|
||||||
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Data-PassiveDns-Domain%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://aka.ms/deploytoazurebutton"/>
|
|
||||||
</a>
|
|
||||||
<a href="https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Data-PassiveDns-Domain%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazuregov.png"/>
|
|
||||||
</a>
|
|
||||||
|
|
@ -1,311 +0,0 @@
|
||||||
{
|
|
||||||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"metadata": {
|
|
||||||
"comments": "Perform automated enrichment on the Azure Sentinel Incidents based on RiskIQ Internet data.",
|
|
||||||
"author": "Brandon Dixon, RiskIQ"
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"PlaybookName": {
|
|
||||||
"defaultValue": "Sentinel-Incident-Enrich-RiskIQ-Data-PassiveDns-IP",
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"UserName": {
|
|
||||||
"defaultValue": "<username>@<domain>",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"variables": {
|
|
||||||
"AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]",
|
|
||||||
"RiskIQConnectionName": "[concat('riskiqpassivetotal-', parameters('PlaybookName'))]"
|
|
||||||
},
|
|
||||||
"resources": [{
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('RiskIQConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Logic/workflows",
|
|
||||||
"apiVersion": "2017-07-01",
|
|
||||||
"name": "[parameters('PlaybookName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"tags": {
|
|
||||||
"LogicAppsCategory": "security"
|
|
||||||
},
|
|
||||||
"dependsOn": [
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]"
|
|
||||||
],
|
|
||||||
"properties": {
|
|
||||||
"state": "Enabled",
|
|
||||||
"definition": {
|
|
||||||
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
|
|
||||||
"actions": {
|
|
||||||
"Alert_-_Get_incident": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/Incidents/subscriptions/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/resourceGroups/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/workspaces/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/alerts/@{encodeURIComponent(triggerBody()?['SystemAlertId'])}"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_IPs": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/ip"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Lookback_Period": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"For_each_ip": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)_2": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>Last week of Passive DNS for @{items('For_each_ip')?['Address']}<br>\n@{variables('ip_comment')}</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Condition_2": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Condition_2": {
|
|
||||||
"actions": {
|
|
||||||
"Create_IP_HTML_table": {
|
|
||||||
"inputs": {
|
|
||||||
"format": "HTML",
|
|
||||||
"from": "@variables('ip_results')"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "Table"
|
|
||||||
},
|
|
||||||
"Set_ip_comment": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "ip_comment",
|
|
||||||
"value": "@body('Create_IP_HTML_table')"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Create_IP_HTML_table": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "SetVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"else": {
|
|
||||||
"actions": {
|
|
||||||
"Set_variable": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "ip_comment",
|
|
||||||
"value": "No results found."
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "SetVariable"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"expression": {
|
|
||||||
"and": [
|
|
||||||
{
|
|
||||||
"greater": [
|
|
||||||
"@length(variables('ip_results'))",
|
|
||||||
0
|
|
||||||
]
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"For_each_ip_resolve": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "If"
|
|
||||||
},
|
|
||||||
"For_each_ip_resolve": {
|
|
||||||
"actions": {
|
|
||||||
"Append_to_array_variable_2": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "ip_results",
|
|
||||||
"value": {
|
|
||||||
"First": "@item()?['firstSeen']",
|
|
||||||
"Last": "@item()?['lastSeen']",
|
|
||||||
"Type": "@items('For_each_ip_resolve')?['recordType']",
|
|
||||||
"Value": "@items('For_each_ip_resolve')?['resolve']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "AppendToArrayVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Get_passive_DNS_2')?['results']",
|
|
||||||
"runAfter": {
|
|
||||||
"Get_passive_DNS_2": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Get_passive_DNS_2": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/dns/passive",
|
|
||||||
"queries": {
|
|
||||||
"query": "@items('For_each_ip')?['Address']",
|
|
||||||
"start": "@variables('lookback')",
|
|
||||||
"timeout": 7
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_IPs')?['IPs']",
|
|
||||||
"runAfter": {
|
|
||||||
"Init_ip_comment": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Init_Lookback_Period": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "lookback",
|
|
||||||
"type": "string",
|
|
||||||
"value": "@{formatDateTime(addDays(utcNow(), -7), 'yyyy-MM-dd')}"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Alert_-_Get_incident": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
},
|
|
||||||
"Init_ip_comment": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "ip_comment",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Init_ip_results": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
},
|
|
||||||
"Init_ip_results": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "ip_results",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_IPs": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"outputs": {},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"defaultValue": {},
|
|
||||||
"type": "Object"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"triggers": {
|
|
||||||
"When_a_response_to_an_Azure_Sentinel_alert_is_triggered": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"callback_url": "@{listCallbackUrl()}"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"path": "/subscribe"
|
|
||||||
},
|
|
||||||
"type": "ApiConnectionWebhook"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"value": {
|
|
||||||
"azuresentinel": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]",
|
|
||||||
"connectionName": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
},
|
|
||||||
"riskiqpassivetotal": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"connectionName": "[variables('RiskIQConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}]
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
# Sentinel-Incident-Enrich-RiskIQ-Data-PassiveDns-IP
|
|
||||||
author: Brandon Dixon, RiskIQ
|
|
||||||
|
|
||||||
This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Azure Sentinel. You need a valid community or enterprise in order to use the connector and playbook. To learn more about the service and request a trial key, [register for free](https://community.riskiq.com/) or see the [API documentation](https://api.passivetotal.org/index.html).
|
|
||||||
|
|
||||||
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Data-PassiveDns-IP%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://aka.ms/deploytoazurebutton"/>
|
|
||||||
</a>
|
|
||||||
<a href="https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Data-PassiveDns-IP%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazuregov.png"/>
|
|
||||||
</a>
|
|
||||||
|
|
@ -1,422 +0,0 @@
|
||||||
{
|
|
||||||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"metadata": {
|
|
||||||
"comments": "Perform automated enrichment on the Azure Sentinel Incidents based on RiskIQ Internet data.",
|
|
||||||
"author": "Brandon Dixon, RiskIQ"
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"PlaybookName": {
|
|
||||||
"defaultValue": "Sentinel-Incident-Enrich-RiskIQ-Data-Summary-All",
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"UserName": {
|
|
||||||
"defaultValue": "<username>@<domain>",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"variables": {
|
|
||||||
"AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]",
|
|
||||||
"RiskIQConnectionName": "[concat('riskiqpassivetotal-', parameters('PlaybookName'))]"
|
|
||||||
},
|
|
||||||
"resources": [{
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('RiskIQConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Logic/workflows",
|
|
||||||
"apiVersion": "2017-07-01",
|
|
||||||
"name": "[parameters('PlaybookName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"tags": {
|
|
||||||
"LogicAppsCategory": "security"
|
|
||||||
},
|
|
||||||
"dependsOn": [
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]"
|
|
||||||
],
|
|
||||||
"properties": {
|
|
||||||
"state": "Enabled",
|
|
||||||
"definition": {
|
|
||||||
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
|
|
||||||
"actions": {
|
|
||||||
"Alert_-_Get_incident": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/Incidents/subscriptions/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/resourceGroups/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/workspaces/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/alerts/@{encodeURIComponent(triggerBody()?['SystemAlertId'])}"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_Hosts": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/host"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Alert_-_Get_incident": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_IPs": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/ip"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Alert_-_Get_incident": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"For_each_Host": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)_2": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>Host Summary<br>\n@{body('Create_Host_HTML_table')}</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Create_Host_HTML_table": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Create_Host_HTML_table": {
|
|
||||||
"inputs": {
|
|
||||||
"format": "HTML",
|
|
||||||
"from": "@variables('result_output_host')"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Format_Host_Record": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Table"
|
|
||||||
},
|
|
||||||
"Format_Host_Record": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "result_output_host",
|
|
||||||
"value": [
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_host')?['data_summary']?['resolutions']?['count']",
|
|
||||||
"Dataset": "Resolutions",
|
|
||||||
"Link": "@body('Get_summary_data_card_host')?['data_summary']?['resolutions']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_host')?['data_summary']?['certificates']?['count']",
|
|
||||||
"Dataset": "Certificates",
|
|
||||||
"Link": "@body('Get_summary_data_card_host')?['data_summary']?['certificates']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_host')?['data_summary']?['trackers']?['count']",
|
|
||||||
"Dataset": "Trackers",
|
|
||||||
"Link": "@body('Get_summary_data_card_host')?['data_summary']?['trackers']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_host')?['data_summary']?['components']?['count']",
|
|
||||||
"Dataset": "Components",
|
|
||||||
"Link": "@body('Get_summary_data_card_host')?['data_summary']?['components']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_host')?['data_summary']?['host_pairs']?['count']",
|
|
||||||
"Dataset": "Host Pairs",
|
|
||||||
"Link": "@body('Get_summary_data_card_host')?['data_summary']?['host_pairs']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_host')?['data_summary']?['cookies']?['count']",
|
|
||||||
"Dataset": "Cookies",
|
|
||||||
"Link": "@body('Get_summary_data_card_host')?['data_summary']?['cookies']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_host')?['data_summary']?['hashes']?['count']",
|
|
||||||
"Dataset": "Hashes",
|
|
||||||
"Link": "@body('Get_summary_data_card_host')?['data_summary']?['hashes']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_host')?['data_summary']?['articles']?['count']",
|
|
||||||
"Dataset": "Articles",
|
|
||||||
"Link": "@body('Get_summary_data_card_host')?['data_summary']?['articles']?['link']"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Get_summary_data_card_host": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "SetVariable"
|
|
||||||
},
|
|
||||||
"Get_summary_data_card_host": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/cards/summary",
|
|
||||||
"queries": {
|
|
||||||
"query": "@items('For_each_Host')?['DnsDomain']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_Hosts')?['Hosts']",
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Result_Host": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"For_each_IP_Address": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>IP Summary<br>\n@{body('Create_IP_HTML_table')}</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Create_IP_HTML_table": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Create_IP_HTML_table": {
|
|
||||||
"inputs": {
|
|
||||||
"format": "HTML",
|
|
||||||
"from": "@variables('result_output_ip')"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Format_IP_Record": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Table"
|
|
||||||
},
|
|
||||||
"Format_IP_Record": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "result_output_ip",
|
|
||||||
"value": [
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_ip')?['data_summary']?['resolutions']?['count']",
|
|
||||||
"Dataset": "Resolutions",
|
|
||||||
"Link": "@body('Get_summary_data_card_ip')?['data_summary']?['resolutions']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_ip')?['data_summary']?['certificates']?['count']",
|
|
||||||
"Dataset": "Certificates",
|
|
||||||
"Link": "@body('Get_summary_data_card_ip')?['data_summary']?['certificates']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_ip')?['data_summary']?['trackers']?['count']",
|
|
||||||
"Dataset": "Trackers",
|
|
||||||
"Link": "@body('Get_summary_data_card_ip')?['data_summary']?['trackers']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_ip')?['data_summary']?['components']?['count']",
|
|
||||||
"Dataset": "Components",
|
|
||||||
"Link": "@body('Get_summary_data_card_ip')?['data_summary']?['components']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_ip')?['data_summary']?['host_pairs']?['count']",
|
|
||||||
"Dataset": "Host Pairs",
|
|
||||||
"Link": "@body('Get_summary_data_card_ip')?['data_summary']?['host_pairs']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_ip')?['data_summary']?['cookies']?['count']",
|
|
||||||
"Dataset": "Cookies",
|
|
||||||
"Link": "@body('Get_summary_data_card_ip')?['data_summary']?['cookies']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_ip')?['data_summary']?['services']?['count']",
|
|
||||||
"Dataset": "Services",
|
|
||||||
"Link": "@body('Get_summary_data_card_ip')?['data_summary']?['services']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_ip')?['data_summary']?['reverse_dns']?['count']",
|
|
||||||
"Dataset": "DNS",
|
|
||||||
"Link": "@body('Get_summary_data_card_ip')?['data_summary']?['reverse_dns']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_ip')?['data_summary']?['hashes']?['count']",
|
|
||||||
"Dataset": "Hashes",
|
|
||||||
"Link": "@body('Get_summary_data_card_ip')?['data_summary']?['hashes']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_ip')?['data_summary']?['articles']?['count']",
|
|
||||||
"Dataset": "Articles",
|
|
||||||
"Link": "@body('Get_summary_data_card_ip')?['data_summary']?['articles']?['link']"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Get_summary_data_card_ip": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "SetVariable"
|
|
||||||
},
|
|
||||||
"Get_summary_data_card_ip": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/cards/summary",
|
|
||||||
"queries": {
|
|
||||||
"query": "@items('For_each_IP_Address')?['Address']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_IPs')?['IPs']",
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Result_IP": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Init_Result_Host": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "result_output_host",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_Hosts": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
},
|
|
||||||
"Init_Result_IP": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "result_output_ip",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_IPs": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"outputs": {},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"defaultValue": {},
|
|
||||||
"type": "Object"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"triggers": {
|
|
||||||
"When_a_response_to_an_Azure_Sentinel_alert_is_triggered": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"callback_url": "@{listCallbackUrl()}"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"path": "/subscribe"
|
|
||||||
},
|
|
||||||
"type": "ApiConnectionWebhook"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"value": {
|
|
||||||
"azuresentinel": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]",
|
|
||||||
"connectionName": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
},
|
|
||||||
"riskiqpassivetotal": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"connectionName": "[variables('RiskIQConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}]
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
# Sentinel-Incident-Enrich-RiskIQ-Data-Summary-All
|
|
||||||
author: Brandon Dixon, RiskIQ
|
|
||||||
|
|
||||||
This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Azure Sentinel. You need a valid community or enterprise in order to use the connector and playbook. To learn more about the service and request a trial key, [register for free](https://community.riskiq.com/) or see the [API documentation](https://api.passivetotal.org/index.html).
|
|
||||||
|
|
||||||
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Data-Summary-All%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://aka.ms/deploytoazurebutton"/>
|
|
||||||
</a>
|
|
||||||
<a href="https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Data-Summary-All%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazuregov.png"/>
|
|
||||||
</a>
|
|
||||||
|
|
@ -1,265 +0,0 @@
|
||||||
{
|
|
||||||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"metadata": {
|
|
||||||
"comments": "Perform automated enrichment on the Azure Sentinel Incidents based on RiskIQ Internet data.",
|
|
||||||
"author": "Brandon Dixon, RiskIQ"
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"PlaybookName": {
|
|
||||||
"defaultValue": "Sentinel-Incident-Enrich-RiskIQ-Data-Summary-Domain",
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"UserName": {
|
|
||||||
"defaultValue": "<username>@<domain>",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"variables": {
|
|
||||||
"AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]",
|
|
||||||
"RiskIQConnectionName": "[concat('riskiqpassivetotal-', parameters('PlaybookName'))]"
|
|
||||||
},
|
|
||||||
"resources": [{
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('RiskIQConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Logic/workflows",
|
|
||||||
"apiVersion": "2017-07-01",
|
|
||||||
"name": "[parameters('PlaybookName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"tags": {
|
|
||||||
"LogicAppsCategory": "security"
|
|
||||||
},
|
|
||||||
"dependsOn": [
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]"
|
|
||||||
],
|
|
||||||
"properties": {
|
|
||||||
"state": "Enabled",
|
|
||||||
"definition": {
|
|
||||||
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
|
|
||||||
"actions": {
|
|
||||||
"Alert_-_Get_incident": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/Incidents/subscriptions/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/resourceGroups/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/workspaces/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/alerts/@{encodeURIComponent(triggerBody()?['SystemAlertId'])}"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_Hosts": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/host"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Alert_-_Get_incident": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"For_each_Host": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)_2": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>Host Summary<br>\n@{body('Create_Host_HTML_table')}</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Create_Host_HTML_table": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Create_Host_HTML_table": {
|
|
||||||
"inputs": {
|
|
||||||
"format": "HTML",
|
|
||||||
"from": "@variables('result_output_host')"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Format_Host_Record": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Table"
|
|
||||||
},
|
|
||||||
"Format_Host_Record": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "result_output_host",
|
|
||||||
"value": [
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_host')?['data_summary']?['resolutions']?['count']",
|
|
||||||
"Dataset": "Resolutions",
|
|
||||||
"Link": "@body('Get_summary_data_card_host')?['data_summary']?['resolutions']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_host')?['data_summary']?['certificates']?['count']",
|
|
||||||
"Dataset": "Certificates",
|
|
||||||
"Link": "@body('Get_summary_data_card_host')?['data_summary']?['certificates']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_host')?['data_summary']?['trackers']?['count']",
|
|
||||||
"Dataset": "Trackers",
|
|
||||||
"Link": "@body('Get_summary_data_card_host')?['data_summary']?['trackers']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_host')?['data_summary']?['components']?['count']",
|
|
||||||
"Dataset": "Components",
|
|
||||||
"Link": "@body('Get_summary_data_card_host')?['data_summary']?['components']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_host')?['data_summary']?['host_pairs']?['count']",
|
|
||||||
"Dataset": "Host Pairs",
|
|
||||||
"Link": "@body('Get_summary_data_card_host')?['data_summary']?['host_pairs']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_host')?['data_summary']?['cookies']?['count']",
|
|
||||||
"Dataset": "Cookies",
|
|
||||||
"Link": "@body('Get_summary_data_card_host')?['data_summary']?['cookies']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_host')?['data_summary']?['hashes']?['count']",
|
|
||||||
"Dataset": "Hashes",
|
|
||||||
"Link": "@body('Get_summary_data_card_host')?['data_summary']?['hashes']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_host')?['data_summary']?['articles']?['count']",
|
|
||||||
"Dataset": "Articles",
|
|
||||||
"Link": "@body('Get_summary_data_card_host')?['data_summary']?['articles']?['link']"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Get_summary_data_card_host": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "SetVariable"
|
|
||||||
},
|
|
||||||
"Get_summary_data_card_host": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/cards/summary",
|
|
||||||
"queries": {
|
|
||||||
"query": "@items('For_each_Host')?['DnsDomain']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_Hosts')?['Hosts']",
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Result_Host": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Init_Result_Host": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "result_output_host",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_Hosts": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"outputs": {},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"defaultValue": {},
|
|
||||||
"type": "Object"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"triggers": {
|
|
||||||
"When_a_response_to_an_Azure_Sentinel_alert_is_triggered": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"callback_url": "@{listCallbackUrl()}"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"path": "/subscribe"
|
|
||||||
},
|
|
||||||
"type": "ApiConnectionWebhook"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"value": {
|
|
||||||
"azuresentinel": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]",
|
|
||||||
"connectionName": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
},
|
|
||||||
"riskiqpassivetotal": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"connectionName": "[variables('RiskIQConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}]
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
# Sentinel-Incident-Enrich-RiskIQ-Data-Summary-Domain
|
|
||||||
author: Brandon Dixon, RiskIQ
|
|
||||||
|
|
||||||
This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Azure Sentinel. You need a valid community or enterprise in order to use the connector and playbook. To learn more about the service and request a trial key, [register for free](https://community.riskiq.com/) or see the [API documentation](https://api.passivetotal.org/index.html).
|
|
||||||
|
|
||||||
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Data-Summary-Domain%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://aka.ms/deploytoazurebutton"/>
|
|
||||||
</a>
|
|
||||||
<a href="https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Data-Summary-Domain%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazuregov.png"/>
|
|
||||||
</a>
|
|
||||||
|
|
@ -1,275 +0,0 @@
|
||||||
{
|
|
||||||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"metadata": {
|
|
||||||
"comments": "Perform automated enrichment on the Azure Sentinel Incidents based on RiskIQ Internet data.",
|
|
||||||
"author": "Brandon Dixon, RiskIQ"
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"PlaybookName": {
|
|
||||||
"defaultValue": "Sentinel-Incident-Enrich-RiskIQ-Data-Summary-IP",
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"UserName": {
|
|
||||||
"defaultValue": "<username>@<domain>",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"variables": {
|
|
||||||
"AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]",
|
|
||||||
"RiskIQConnectionName": "[concat('riskiqpassivetotal-', parameters('PlaybookName'))]"
|
|
||||||
},
|
|
||||||
"resources": [{
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('RiskIQConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Logic/workflows",
|
|
||||||
"apiVersion": "2017-07-01",
|
|
||||||
"name": "[parameters('PlaybookName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"tags": {
|
|
||||||
"LogicAppsCategory": "security"
|
|
||||||
},
|
|
||||||
"dependsOn": [
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]"
|
|
||||||
],
|
|
||||||
"properties": {
|
|
||||||
"state": "Enabled",
|
|
||||||
"definition": {
|
|
||||||
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
|
|
||||||
"actions": {
|
|
||||||
"Alert_-_Get_incident": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/Incidents/subscriptions/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/resourceGroups/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/workspaces/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/alerts/@{encodeURIComponent(triggerBody()?['SystemAlertId'])}"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_IPs": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/ip"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Alert_-_Get_incident": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"For_each_IP_Address": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>IP Summary<br>\n@{body('Create_IP_HTML_table')}</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Create_IP_HTML_table": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Create_IP_HTML_table": {
|
|
||||||
"inputs": {
|
|
||||||
"format": "HTML",
|
|
||||||
"from": "@variables('result_output_ip')"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Format_IP_Record": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Table"
|
|
||||||
},
|
|
||||||
"Format_IP_Record": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "result_output_ip",
|
|
||||||
"value": [
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_ip')?['data_summary']?['resolutions']?['count']",
|
|
||||||
"Dataset": "Resolutions",
|
|
||||||
"Link": "@body('Get_summary_data_card_ip')?['data_summary']?['resolutions']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_ip')?['data_summary']?['certificates']?['count']",
|
|
||||||
"Dataset": "Certificates",
|
|
||||||
"Link": "@body('Get_summary_data_card_ip')?['data_summary']?['certificates']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_ip')?['data_summary']?['trackers']?['count']",
|
|
||||||
"Dataset": "Trackers",
|
|
||||||
"Link": "@body('Get_summary_data_card_ip')?['data_summary']?['trackers']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_ip')?['data_summary']?['components']?['count']",
|
|
||||||
"Dataset": "Components",
|
|
||||||
"Link": "@body('Get_summary_data_card_ip')?['data_summary']?['components']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_ip')?['data_summary']?['host_pairs']?['count']",
|
|
||||||
"Dataset": "Host Pairs",
|
|
||||||
"Link": "@body('Get_summary_data_card_ip')?['data_summary']?['host_pairs']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_ip')?['data_summary']?['cookies']?['count']",
|
|
||||||
"Dataset": "Cookies",
|
|
||||||
"Link": "@body('Get_summary_data_card_ip')?['data_summary']?['cookies']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_ip')?['data_summary']?['services']?['count']",
|
|
||||||
"Dataset": "Services",
|
|
||||||
"Link": "@body('Get_summary_data_card_ip')?['data_summary']?['services']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_ip')?['data_summary']?['reverse_dns']?['count']",
|
|
||||||
"Dataset": "DNS",
|
|
||||||
"Link": "@body('Get_summary_data_card_ip')?['data_summary']?['reverse_dns']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_ip')?['data_summary']?['hashes']?['count']",
|
|
||||||
"Dataset": "Hashes",
|
|
||||||
"Link": "@body('Get_summary_data_card_ip')?['data_summary']?['hashes']?['link']"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"Count": "@body('Get_summary_data_card_ip')?['data_summary']?['articles']?['count']",
|
|
||||||
"Dataset": "Articles",
|
|
||||||
"Link": "@body('Get_summary_data_card_ip')?['data_summary']?['articles']?['link']"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Get_summary_data_card_ip": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "SetVariable"
|
|
||||||
},
|
|
||||||
"Get_summary_data_card_ip": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/cards/summary",
|
|
||||||
"queries": {
|
|
||||||
"query": "@items('For_each_IP_Address')?['Address']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_IPs')?['IPs']",
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Result_IP": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Init_Result_IP": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "result_output_ip",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_IPs": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"outputs": {},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"defaultValue": {},
|
|
||||||
"type": "Object"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"triggers": {
|
|
||||||
"When_a_response_to_an_Azure_Sentinel_alert_is_triggered": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"callback_url": "@{listCallbackUrl()}"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"path": "/subscribe"
|
|
||||||
},
|
|
||||||
"type": "ApiConnectionWebhook"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"value": {
|
|
||||||
"azuresentinel": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]",
|
|
||||||
"connectionName": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
},
|
|
||||||
"riskiqpassivetotal": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"connectionName": "[variables('RiskIQConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}]
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
# Sentinel-Incident-Enrich-RiskIQ-Data-Summary-IP
|
|
||||||
author: Brandon Dixon, RiskIQ
|
|
||||||
|
|
||||||
This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Azure Sentinel. You need a valid community or enterprise in order to use the connector and playbook. To learn more about the service and request a trial key, [register for free](https://community.riskiq.com/) or see the [API documentation](https://api.passivetotal.org/index.html).
|
|
||||||
|
|
||||||
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Data-Summary-IP%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://aka.ms/deploytoazurebutton"/>
|
|
||||||
</a>
|
|
||||||
<a href="https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Data-Summary-IP%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazuregov.png"/>
|
|
||||||
</a>
|
|
||||||
|
|
@ -1,250 +0,0 @@
|
||||||
{
|
|
||||||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"metadata": {
|
|
||||||
"comments": "Perform automated enrichment on the Azure Sentinel Incidents based on RiskIQ Internet data.",
|
|
||||||
"author": "Brandon Dixon, RiskIQ"
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"PlaybookName": {
|
|
||||||
"defaultValue": "Sentinel-Incident-Enrich-RiskIQ-Data-Whois-All",
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"UserName": {
|
|
||||||
"defaultValue": "<username>@<domain>",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"variables": {
|
|
||||||
"AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]",
|
|
||||||
"RiskIQConnectionName": "[concat('riskiqpassivetotal-', parameters('PlaybookName'))]"
|
|
||||||
},
|
|
||||||
"resources": [{
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('RiskIQConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Logic/workflows",
|
|
||||||
"apiVersion": "2017-07-01",
|
|
||||||
"name": "[parameters('PlaybookName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"tags": {
|
|
||||||
"LogicAppsCategory": "security"
|
|
||||||
},
|
|
||||||
"dependsOn": [
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]"
|
|
||||||
],
|
|
||||||
"properties": {
|
|
||||||
"state": "Enabled",
|
|
||||||
"definition": {
|
|
||||||
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
|
|
||||||
"actions": {
|
|
||||||
"Alert_-_Get_incident": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/Incidents/subscriptions/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/resourceGroups/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/workspaces/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/alerts/@{encodeURIComponent(triggerBody()?['SystemAlertId'])}"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_Hosts": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/host"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Alert_-_Get_incident": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_IPs": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/ip"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Alert_-_Get_incident": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"For_each_host": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>Associated WHOIS record for @{items('For_each_host')?['HostName']}.@{items('For_each_host')?['DnsDomain']}:<br>\n<br>\nRegistrar: @{body('Get_WHOIS')?['registrar']}<br>\nRegistered:@{body('Get_WHOIS')?['registered']}<br>\nExpires: @{body('Get_WHOIS')?['expiresAt']}<br>\nContact: @{body('Get_WHOIS')?['contactEmail']}<br>\nNameservers: @{body('Get_WHOIS')?['nameServers']}<br>\n<br>\nTo search on WHOIS data or view historic records, see https://community.riskiq.com/search/@{items('For_each_host')?['HostName']}.@{items('For_each_host')?['DnsDomain']}/whois</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Get_WHOIS": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Get_WHOIS": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/whois",
|
|
||||||
"queries": {
|
|
||||||
"query": "@{items('For_each_host')?['HostName']}.@{items('For_each_host')?['DnsDomain']}"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_Hosts')?['Hosts']",
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_Hosts": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"For_each_ip": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)_2": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>Associated WHOIS record for @{items('For_each_ip')?['Address']}:<br>\n<br>\nRegistrar: @{body('Get_WHOIS_IP')?['registrar']}<br>\nRegistered:@{body('Get_WHOIS_IP')?['registered']}<br>\nExpires: @{body('Get_WHOIS_IP')?['expiresAt']}<br>\nContact: @{body('Get_WHOIS_IP')?['contactEmail']}<br>\nNameservers: @{body('Get_WHOIS_IP')?['nameServers']}<br>\n<br>\nTo search on WHOIS data or view historic records, see https://community.riskiq.com/search/@{items('For_each_ip')?['Address']}/whois</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Get_WHOIS_IP": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Get_WHOIS_IP": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/whois",
|
|
||||||
"queries": {
|
|
||||||
"query": "@items('For_each_ip')?['Address']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_IPs')?['IPs']",
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_IPs": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"outputs": {},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"defaultValue": {},
|
|
||||||
"type": "Object"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"triggers": {
|
|
||||||
"When_a_response_to_an_Azure_Sentinel_alert_is_triggered": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"callback_url": "@{listCallbackUrl()}"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"path": "/subscribe"
|
|
||||||
},
|
|
||||||
"type": "ApiConnectionWebhook"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"value": {
|
|
||||||
"azuresentinel": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]",
|
|
||||||
"connectionName": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
},
|
|
||||||
"riskiqpassivetotal": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"connectionName": "[variables('RiskIQConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}]
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
# Sentinel-Incident-Enrich-RiskIQ-Data-Whois-All
|
|
||||||
author: Brandon Dixon, RiskIQ
|
|
||||||
|
|
||||||
This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Azure Sentinel. You need a valid community or enterprise in order to use the connector and playbook. To learn more about the service and request a trial key, [register for free](https://community.riskiq.com/) or see the [API documentation](https://api.passivetotal.org/index.html).
|
|
||||||
|
|
||||||
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Data-Whois-All%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://aka.ms/deploytoazurebutton"/>
|
|
||||||
</a>
|
|
||||||
<a href="https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Data-Whois-All%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazuregov.png"/>
|
|
||||||
</a>
|
|
||||||
|
|
@ -1,184 +0,0 @@
|
||||||
{
|
|
||||||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"metadata": {
|
|
||||||
"comments": "Perform automated enrichment on the Azure Sentinel Incidents based on RiskIQ Internet data.",
|
|
||||||
"author": "Brandon Dixon, RiskIQ"
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"PlaybookName": {
|
|
||||||
"defaultValue": "Sentinel-Incident-Enrich-RiskIQ-Data-Whois-Domain",
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"UserName": {
|
|
||||||
"defaultValue": "<username>@<domain>",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"variables": {
|
|
||||||
"AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]",
|
|
||||||
"RiskIQConnectionName": "[concat('riskiqpassivetotal-', parameters('PlaybookName'))]"
|
|
||||||
},
|
|
||||||
"resources": [{
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('RiskIQConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Logic/workflows",
|
|
||||||
"apiVersion": "2017-07-01",
|
|
||||||
"name": "[parameters('PlaybookName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"tags": {
|
|
||||||
"LogicAppsCategory": "security"
|
|
||||||
},
|
|
||||||
"dependsOn": [
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]"
|
|
||||||
],
|
|
||||||
"properties": {
|
|
||||||
"state": "Enabled",
|
|
||||||
"definition": {
|
|
||||||
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
|
|
||||||
"actions": {
|
|
||||||
"Alert_-_Get_incident": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/Incidents/subscriptions/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/resourceGroups/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/workspaces/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/alerts/@{encodeURIComponent(triggerBody()?['SystemAlertId'])}"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_Hosts": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/host"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Alert_-_Get_incident": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"For_each_host": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>Associated WHOIS record for @{items('For_each_host')?['HostName']}.@{items('For_each_host')?['DnsDomain']}:<br>\n<br>\nRegistrar: @{body('Get_WHOIS')?['registrar']}<br>\nRegistered:@{body('Get_WHOIS')?['registered']}<br>\nExpires: @{body('Get_WHOIS')?['expiresAt']}<br>\nContact: @{body('Get_WHOIS')?['contactEmail']}<br>\nNameservers: @{body('Get_WHOIS')?['nameServers']}<br>\n<br>\nTo search on WHOIS data or view historic records, see https://community.riskiq.com/search/@{items('For_each_host')?['HostName']}.@{items('For_each_host')?['DnsDomain']}/whois</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Get_WHOIS": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Get_WHOIS": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/whois",
|
|
||||||
"queries": {
|
|
||||||
"query": "@{items('For_each_host')?['HostName']}.@{items('For_each_host')?['DnsDomain']}"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_Hosts')?['Hosts']",
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_Hosts": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"outputs": {},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"defaultValue": {},
|
|
||||||
"type": "Object"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"triggers": {
|
|
||||||
"When_a_response_to_an_Azure_Sentinel_alert_is_triggered": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"callback_url": "@{listCallbackUrl()}"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"path": "/subscribe"
|
|
||||||
},
|
|
||||||
"type": "ApiConnectionWebhook"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"value": {
|
|
||||||
"azuresentinel": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]",
|
|
||||||
"connectionName": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
},
|
|
||||||
"riskiqpassivetotal": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"connectionName": "[variables('RiskIQConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}]
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
# Sentinel-Incident-Enrich-RiskIQ-Data-Whois-Domain
|
|
||||||
author: Brandon Dixon, RiskIQ
|
|
||||||
|
|
||||||
This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Azure Sentinel. You need a valid community or enterprise in order to use the connector and playbook. To learn more about the service and request a trial key, [register for free](https://community.riskiq.com/) or see the [API documentation](https://api.passivetotal.org/index.html).
|
|
||||||
|
|
||||||
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Data-Whois-Domain%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://aka.ms/deploytoazurebutton"/>
|
|
||||||
</a>
|
|
||||||
<a href="https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Data-Whois-Domain%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazuregov.png"/>
|
|
||||||
</a>
|
|
||||||
|
|
@ -1,184 +0,0 @@
|
||||||
{
|
|
||||||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"metadata": {
|
|
||||||
"comments": "Perform automated enrichment on the Azure Sentinel Incidents based on RiskIQ Internet data.",
|
|
||||||
"author": "Brandon Dixon, RiskIQ"
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"PlaybookName": {
|
|
||||||
"defaultValue": "Sentinel-Incident-Enrich-RiskIQ-Data-Whois-IP",
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"UserName": {
|
|
||||||
"defaultValue": "<username>@<domain>",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"variables": {
|
|
||||||
"AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]",
|
|
||||||
"RiskIQConnectionName": "[concat('riskiqpassivetotal-', parameters('PlaybookName'))]"
|
|
||||||
},
|
|
||||||
"resources": [{
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('RiskIQConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Logic/workflows",
|
|
||||||
"apiVersion": "2017-07-01",
|
|
||||||
"name": "[parameters('PlaybookName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"tags": {
|
|
||||||
"LogicAppsCategory": "security"
|
|
||||||
},
|
|
||||||
"dependsOn": [
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]"
|
|
||||||
],
|
|
||||||
"properties": {
|
|
||||||
"state": "Enabled",
|
|
||||||
"definition": {
|
|
||||||
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
|
|
||||||
"actions": {
|
|
||||||
"Alert_-_Get_incident": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/Incidents/subscriptions/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/resourceGroups/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/workspaces/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/alerts/@{encodeURIComponent(triggerBody()?['SystemAlertId'])}"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_IPs": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/ip"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Alert_-_Get_incident": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"For_each_ip": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)_2": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>Associated WHOIS record for @{items('For_each_ip')?['Address']}:<br>\n<br>\nRegistrar: @{body('Get_WHOIS_IP')?['registrar']}<br>\nRegistered:@{body('Get_WHOIS_IP')?['registered']}<br>\nExpires: @{body('Get_WHOIS_IP')?['expiresAt']}<br>\nContact: @{body('Get_WHOIS_IP')?['contactEmail']}<br>\nNameservers: @{body('Get_WHOIS_IP')?['nameServers']}<br>\n<br>\nTo search on WHOIS data or view historic records, see https://community.riskiq.com/search/@{items('For_each_ip')?['Address']}/whois</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Get_WHOIS_IP": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Get_WHOIS_IP": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/whois",
|
|
||||||
"queries": {
|
|
||||||
"query": "@items('For_each_ip')?['Address']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_IPs')?['IPs']",
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_IPs": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"outputs": {},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"defaultValue": {},
|
|
||||||
"type": "Object"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"triggers": {
|
|
||||||
"When_a_response_to_an_Azure_Sentinel_alert_is_triggered": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"callback_url": "@{listCallbackUrl()}"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"path": "/subscribe"
|
|
||||||
},
|
|
||||||
"type": "ApiConnectionWebhook"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"value": {
|
|
||||||
"azuresentinel": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]",
|
|
||||||
"connectionName": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
},
|
|
||||||
"riskiqpassivetotal": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"connectionName": "[variables('RiskIQConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}]
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
# Sentinel-Incident-Enrich-RiskIQ-Data-Whois-IP
|
|
||||||
author: Brandon Dixon, RiskIQ
|
|
||||||
|
|
||||||
This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Azure Sentinel. You need a valid community or enterprise in order to use the connector and playbook. To learn more about the service and request a trial key, [register for free](https://community.riskiq.com/) or see the [API documentation](https://api.passivetotal.org/index.html).
|
|
||||||
|
|
||||||
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Data-Whois-IP%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://aka.ms/deploytoazurebutton"/>
|
|
||||||
</a>
|
|
||||||
<a href="https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Data-Whois-IP%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazuregov.png"/>
|
|
||||||
</a>
|
|
||||||
|
|
@ -1,350 +0,0 @@
|
||||||
{
|
|
||||||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"metadata": {
|
|
||||||
"comments": "Perform automated enrichment on the Azure Sentinel Incidents based on RiskIQ Intelligence data.",
|
|
||||||
"author": "Brandon Dixon, RiskIQ"
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"PlaybookName": {
|
|
||||||
"defaultValue": "Sentinel-Incident-Enrich-RiskIQ-Intel-Summary-All",
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"UserName": {
|
|
||||||
"defaultValue": "<username>@<domain>",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"variables": {
|
|
||||||
"AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]",
|
|
||||||
"RiskIQConnectionName": "[concat('riskiqpassivetotal-', parameters('PlaybookName'))]"
|
|
||||||
},
|
|
||||||
"resources": [{
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('RiskIQConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Logic/workflows",
|
|
||||||
"apiVersion": "2017-07-01",
|
|
||||||
"name": "[parameters('PlaybookName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"tags": {
|
|
||||||
"LogicAppsCategory": "security"
|
|
||||||
},
|
|
||||||
"dependsOn": [
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]"
|
|
||||||
],
|
|
||||||
"properties": {
|
|
||||||
"state": "Enabled",
|
|
||||||
"definition": {
|
|
||||||
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
|
|
||||||
"actions": {
|
|
||||||
"Alert_-_Get_incident": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/Incidents/subscriptions/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/resourceGroups/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/workspaces/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/alerts/@{encodeURIComponent(triggerBody()?['SystemAlertId'])}"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_Hosts": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/host"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Alert_-_Get_incident": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_IPs": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/ip"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Alert_-_Get_incident": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"For_each_Host": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)_2": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>Threat Article Results: @{items('For_each_Host')?['HostName']}.@{items('For_each_Host')?['DnsDomain']}<br>\n@{body('Create_Host_HTML_table')}</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Create_Host_HTML_table": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Create_Host_HTML_table": {
|
|
||||||
"inputs": {
|
|
||||||
"format": "HTML",
|
|
||||||
"from": "@variables('result_output_host')"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"For_each_host_article": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Table"
|
|
||||||
},
|
|
||||||
"For_each_host_article": {
|
|
||||||
"actions": {
|
|
||||||
"Append_to_host_array": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "result_output_host",
|
|
||||||
"value": {
|
|
||||||
"Link": "@item()['link']",
|
|
||||||
"Title": "@item()['title']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "AppendToArrayVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Get_articles_by_indicator_host')?['articles']",
|
|
||||||
"runAfter": {
|
|
||||||
"Get_articles_by_indicator_host": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Get_articles_by_indicator_host": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/articles/indicator",
|
|
||||||
"queries": {
|
|
||||||
"query": "@{items('For_each_Host')?['HostName']}.@{items('For_each_Host')?['DnsDomain']}"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_Hosts')?['Hosts']",
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Result_Host": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"For_each_IP_Address": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>Threat Article Results: @{items('For_each_IP_Address')?['Address']}<br>\n@{body('Create_IP_HTML_table')}</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Create_IP_HTML_table": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Create_IP_HTML_table": {
|
|
||||||
"inputs": {
|
|
||||||
"format": "HTML",
|
|
||||||
"from": "@variables('result_output_ip')"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"For_each_ip_article": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Table"
|
|
||||||
},
|
|
||||||
"For_each_ip_article": {
|
|
||||||
"actions": {
|
|
||||||
"Append_to_array_variable": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "result_output_ip",
|
|
||||||
"value": {
|
|
||||||
"Link": "@item()['link']",
|
|
||||||
"Title": "@item()['title']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "AppendToArrayVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Get_articles_by_indicator_ip')?['articles']",
|
|
||||||
"runAfter": {
|
|
||||||
"Get_articles_by_indicator_ip": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Get_articles_by_indicator_ip": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/articles/indicator",
|
|
||||||
"queries": {
|
|
||||||
"query": "@items('For_each_IP_Address')?['Address']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_IPs')?['IPs']",
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Result_IP": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Init_Result_Host": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "result_output_host",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_Hosts": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
},
|
|
||||||
"Init_Result_IP": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "result_output_ip",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_IPs": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"outputs": {},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"defaultValue": {},
|
|
||||||
"type": "Object"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"triggers": {
|
|
||||||
"When_a_response_to_an_Azure_Sentinel_alert_is_triggered": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"callback_url": "@{listCallbackUrl()}"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"path": "/subscribe"
|
|
||||||
},
|
|
||||||
"type": "ApiConnectionWebhook"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"value": {
|
|
||||||
"azuresentinel": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]",
|
|
||||||
"connectionName": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
},
|
|
||||||
"riskiqpassivetotal": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"connectionName": "[variables('RiskIQConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}]
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
# Sentinel-Incident-Enrich-RiskIQ-Intel-Summary-All
|
|
||||||
author: Brandon Dixon, RiskIQ
|
|
||||||
|
|
||||||
This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Azure Sentinel. You need a valid community or enterprise in order to use the connector and playbook. To learn more about the service and request a trial key, [register for free](https://community.riskiq.com/) or see the [API documentation](https://api.passivetotal.org/index.html).
|
|
||||||
|
|
||||||
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Intel-Summary-All%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://aka.ms/deploytoazurebutton"/>
|
|
||||||
</a>
|
|
||||||
<a href="https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Intel-Summary-All%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazuregov.png"/>
|
|
||||||
</a>
|
|
||||||
|
|
@ -1,234 +0,0 @@
|
||||||
{
|
|
||||||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"metadata": {
|
|
||||||
"comments": "Perform automated enrichment on the Azure Sentinel Incidents based on RiskIQ Intelligence data.",
|
|
||||||
"author": "Brandon Dixon, RiskIQ"
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"PlaybookName": {
|
|
||||||
"defaultValue": "Sentinel-Incident-Enrich-RiskIQ-Intel-Summary-Domain",
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"UserName": {
|
|
||||||
"defaultValue": "<username>@<domain>",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"variables": {
|
|
||||||
"AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]",
|
|
||||||
"RiskIQConnectionName": "[concat('riskiqpassivetotal-', parameters('PlaybookName'))]"
|
|
||||||
},
|
|
||||||
"resources": [{
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('RiskIQConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Logic/workflows",
|
|
||||||
"apiVersion": "2017-07-01",
|
|
||||||
"name": "[parameters('PlaybookName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"tags": {
|
|
||||||
"LogicAppsCategory": "security"
|
|
||||||
},
|
|
||||||
"dependsOn": [
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]"
|
|
||||||
],
|
|
||||||
"properties": {
|
|
||||||
"state": "Enabled",
|
|
||||||
"definition": {
|
|
||||||
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
|
|
||||||
"actions": {
|
|
||||||
"Alert_-_Get_incident": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/Incidents/subscriptions/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/resourceGroups/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/workspaces/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/alerts/@{encodeURIComponent(triggerBody()?['SystemAlertId'])}"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_Hosts": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/host"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Alert_-_Get_incident": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"For_each_Host": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)_2": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>Threat Article Results: @{items('For_each_Host')?['HostName']}.@{items('For_each_Host')?['DnsDomain']}<br>\n@{body('Create_Host_HTML_table')}</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Create_Host_HTML_table": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Create_Host_HTML_table": {
|
|
||||||
"inputs": {
|
|
||||||
"format": "HTML",
|
|
||||||
"from": "@variables('result_output_host')"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"For_each_host_article": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Table"
|
|
||||||
},
|
|
||||||
"For_each_host_article": {
|
|
||||||
"actions": {
|
|
||||||
"Append_to_host_array": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "result_output_host",
|
|
||||||
"value": {
|
|
||||||
"Link": "@item()['link']",
|
|
||||||
"Title": "@item()['title']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "AppendToArrayVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Get_articles_by_indicator_host')?['articles']",
|
|
||||||
"runAfter": {
|
|
||||||
"Get_articles_by_indicator_host": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Get_articles_by_indicator_host": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/articles/indicator",
|
|
||||||
"queries": {
|
|
||||||
"query": "@{items('For_each_Host')?['HostName']}.@{items('For_each_Host')?['DnsDomain']}"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_Hosts')?['Hosts']",
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Result_Host": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Init_Result_Host": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "result_output_host",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_Hosts": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"outputs": {},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"defaultValue": {},
|
|
||||||
"type": "Object"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"triggers": {
|
|
||||||
"When_a_response_to_an_Azure_Sentinel_alert_is_triggered": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"callback_url": "@{listCallbackUrl()}"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"path": "/subscribe"
|
|
||||||
},
|
|
||||||
"type": "ApiConnectionWebhook"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"value": {
|
|
||||||
"azuresentinel": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]",
|
|
||||||
"connectionName": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
},
|
|
||||||
"riskiqpassivetotal": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"connectionName": "[variables('RiskIQConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}]
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
# Sentinel-Incident-Enrich-RiskIQ-Intel-Summary-Domain
|
|
||||||
author: Brandon Dixon, RiskIQ
|
|
||||||
|
|
||||||
This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Azure Sentinel. You need a valid community or enterprise in order to use the connector and playbook. To learn more about the service and request a trial key, [register for free](https://community.riskiq.com/) or see the [API documentation](https://api.passivetotal.org/index.html).
|
|
||||||
|
|
||||||
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Intel-Summary-Domain%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://aka.ms/deploytoazurebutton"/>
|
|
||||||
</a>
|
|
||||||
<a href="https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Intel-Summary-Domain%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazuregov.png"/>
|
|
||||||
</a>
|
|
||||||
|
|
@ -1,234 +0,0 @@
|
||||||
{
|
|
||||||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"metadata": {
|
|
||||||
"comments": "Perform automated enrichment on the Azure Sentinel Incidents based on RiskIQ Intelligence data.",
|
|
||||||
"author": "Brandon Dixon, RiskIQ"
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"PlaybookName": {
|
|
||||||
"defaultValue": "Sentinel-Incident-Enrich-RiskIQ-Intel-Summary-IP",
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"UserName": {
|
|
||||||
"defaultValue": "<username>@<domain>",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"variables": {
|
|
||||||
"AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]",
|
|
||||||
"RiskIQConnectionName": "[concat('riskiqpassivetotal-', parameters('PlaybookName'))]"
|
|
||||||
},
|
|
||||||
"resources": [{
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('RiskIQConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Logic/workflows",
|
|
||||||
"apiVersion": "2017-07-01",
|
|
||||||
"name": "[parameters('PlaybookName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"tags": {
|
|
||||||
"LogicAppsCategory": "security"
|
|
||||||
},
|
|
||||||
"dependsOn": [
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]"
|
|
||||||
],
|
|
||||||
"properties": {
|
|
||||||
"state": "Enabled",
|
|
||||||
"definition": {
|
|
||||||
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
|
|
||||||
"actions": {
|
|
||||||
"Alert_-_Get_incident": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/Incidents/subscriptions/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/resourceGroups/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/workspaces/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/alerts/@{encodeURIComponent(triggerBody()?['SystemAlertId'])}"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_IPs": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/ip"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Alert_-_Get_incident": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"For_each_IP_Address": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>Threat Article Results: @{items('For_each_IP_Address')?['Address']}<br>\n@{body('Create_IP_HTML_table')}</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Create_IP_HTML_table": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Create_IP_HTML_table": {
|
|
||||||
"inputs": {
|
|
||||||
"format": "HTML",
|
|
||||||
"from": "@variables('result_output_ip')"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"For_each_ip_article": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Table"
|
|
||||||
},
|
|
||||||
"For_each_ip_article": {
|
|
||||||
"actions": {
|
|
||||||
"Append_to_array_variable": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "result_output_ip",
|
|
||||||
"value": {
|
|
||||||
"Link": "@item()['link']",
|
|
||||||
"Title": "@item()['title']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "AppendToArrayVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Get_articles_by_indicator_ip')?['articles']",
|
|
||||||
"runAfter": {
|
|
||||||
"Get_articles_by_indicator_ip": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Get_articles_by_indicator_ip": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/articles/indicator",
|
|
||||||
"queries": {
|
|
||||||
"query": "@items('For_each_IP_Address')?['Address']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_IPs')?['IPs']",
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Result_IP": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Init_Result_IP": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "result_output_ip",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_IPs": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"outputs": {},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"defaultValue": {},
|
|
||||||
"type": "Object"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"triggers": {
|
|
||||||
"When_a_response_to_an_Azure_Sentinel_alert_is_triggered": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"callback_url": "@{listCallbackUrl()}"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"path": "/subscribe"
|
|
||||||
},
|
|
||||||
"type": "ApiConnectionWebhook"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"value": {
|
|
||||||
"azuresentinel": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]",
|
|
||||||
"connectionName": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
},
|
|
||||||
"riskiqpassivetotal": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"connectionName": "[variables('RiskIQConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}]
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
# Sentinel-Incident-Enrich-RiskIQ-Intel-Summary-IP
|
|
||||||
author: Brandon Dixon, RiskIQ
|
|
||||||
|
|
||||||
This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Azure Sentinel. You need a valid community or enterprise in order to use the connector and playbook. To learn more about the service and request a trial key, [register for free](https://community.riskiq.com/) or see the [API documentation](https://api.passivetotal.org/index.html).
|
|
||||||
|
|
||||||
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Intel-Summary-IP%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://aka.ms/deploytoazurebutton"/>
|
|
||||||
</a>
|
|
||||||
<a href="https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Intel-Summary-IP%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazuregov.png"/>
|
|
||||||
</a>
|
|
||||||
|
|
@ -1,330 +0,0 @@
|
||||||
{
|
|
||||||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"metadata": {
|
|
||||||
"comments": "Perform automated enrichment on the Azure Sentinel Incidents based on RiskIQ Reputation data.",
|
|
||||||
"author": "Brandon Dixon, RiskIQ"
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"PlaybookName": {
|
|
||||||
"defaultValue": "Sentinel-Incident-Enrich-RiskIQ-Reputation-Summary-All",
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"UserName": {
|
|
||||||
"defaultValue": "<username>@<domain>",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"variables": {
|
|
||||||
"AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]",
|
|
||||||
"RiskIQConnectionName": "[concat('riskiqpassivetotal-', parameters('PlaybookName'))]"
|
|
||||||
},
|
|
||||||
"resources": [{
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('RiskIQConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Logic/workflows",
|
|
||||||
"apiVersion": "2017-07-01",
|
|
||||||
"name": "[parameters('PlaybookName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"tags": {
|
|
||||||
"LogicAppsCategory": "security"
|
|
||||||
},
|
|
||||||
"dependsOn": [
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]"
|
|
||||||
],
|
|
||||||
"properties": {
|
|
||||||
"state": "Enabled",
|
|
||||||
"definition": {
|
|
||||||
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
|
|
||||||
"actions": {
|
|
||||||
"Alert_-_Get_incident": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/Incidents/subscriptions/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/resourceGroups/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/workspaces/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/alerts/@{encodeURIComponent(triggerBody()?['SystemAlertId'])}"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_Hosts": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/host"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Alert_-_Get_incident": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_IPs": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/ip"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Alert_-_Get_incident": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"For_each_Host": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>RiskIQ Reputation: @{items('For_each_Host')?['HostName']}.@{items('For_each_Host')?['DnsDomain']}<br>\nClassification: @{body('Get_reputation_for_host')?['classification']} (@{body('Get_reputation_for_host')?['score']})<br>\n@{body('Create_Host_HTML_table')}</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Create_Host_HTML_table": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Create_Host_HTML_table": {
|
|
||||||
"inputs": {
|
|
||||||
"format": "HTML",
|
|
||||||
"from": "@variables('result_output_host')"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Set_host_variable": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Table"
|
|
||||||
},
|
|
||||||
"Get_reputation_for_host": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/reputation",
|
|
||||||
"queries": {
|
|
||||||
"query": "@{items('For_each_Host')?['HostName']}.@{items('For_each_Host')?['DnsDomain']}"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Set_host_variable": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "result_output_host",
|
|
||||||
"value": "@body('Get_reputation_for_host')?['rules']"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Get_reputation_for_host": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "SetVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_Hosts')?['Hosts']",
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Result_Host": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"For_each_IP_Address": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)_2": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>RiskIQ Reputation: @{items('For_each_IP_Address')?['Address']}<br>\nClassification: @{body('Get_reputation')?['classification']} (@{body('Get_reputation')?['score']})<br>\n@{body('Create_IP_HTML_table')}</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Create_IP_HTML_table": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Create_IP_HTML_table": {
|
|
||||||
"inputs": {
|
|
||||||
"format": "HTML",
|
|
||||||
"from": "@variables('result_output_ip')"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Set_ip_variable": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Table"
|
|
||||||
},
|
|
||||||
"Get_reputation": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/reputation",
|
|
||||||
"queries": {
|
|
||||||
"query": "@items('For_each_IP_Address')?['Address']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Set_ip_variable": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "result_output_ip",
|
|
||||||
"value": "@body('Get_reputation')?['rules']"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Get_reputation": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "SetVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_IPs')?['IPs']",
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Result_IP": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Init_Result_Host": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "result_output_host",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_Hosts": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
},
|
|
||||||
"Init_Result_IP": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "result_output_ip",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_IPs": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"outputs": {},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"defaultValue": {},
|
|
||||||
"type": "Object"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"triggers": {
|
|
||||||
"When_a_response_to_an_Azure_Sentinel_alert_is_triggered": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"callback_url": "@{listCallbackUrl()}"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"path": "/subscribe"
|
|
||||||
},
|
|
||||||
"type": "ApiConnectionWebhook"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"value": {
|
|
||||||
"azuresentinel": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]",
|
|
||||||
"connectionName": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
},
|
|
||||||
"riskiqpassivetotal": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"connectionName": "[variables('RiskIQConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}]
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
# Sentinel-Incident-Enrich-RiskIQ-Reputation-Summary-All
|
|
||||||
author: Brandon Dixon, RiskIQ
|
|
||||||
|
|
||||||
This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Azure Sentinel. You need a valid community or enterprise in order to use the connector and playbook. To learn more about the service and request a trial key, [register for free](https://community.riskiq.com/) or see the [API documentation](https://api.passivetotal.org/index.html).
|
|
||||||
|
|
||||||
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Reputation-Summary-All%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://aka.ms/deploytoazurebutton"/>
|
|
||||||
</a>
|
|
||||||
<a href="https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Reputation-Summary-All%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazuregov.png"/>
|
|
||||||
</a>
|
|
||||||
|
|
@ -1,224 +0,0 @@
|
||||||
{
|
|
||||||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"metadata": {
|
|
||||||
"comments": "Perform automated enrichment on the Azure Sentinel Incidents based on RiskIQ Reputation data.",
|
|
||||||
"author": "Brandon Dixon, RiskIQ"
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"PlaybookName": {
|
|
||||||
"defaultValue": "Sentinel-Incident-Enrich-RiskIQ-Reputation-Summary-Domain",
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"UserName": {
|
|
||||||
"defaultValue": "<username>@<domain>",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"variables": {
|
|
||||||
"AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]",
|
|
||||||
"RiskIQConnectionName": "[concat('riskiqpassivetotal-', parameters('PlaybookName'))]"
|
|
||||||
},
|
|
||||||
"resources": [{
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('RiskIQConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Logic/workflows",
|
|
||||||
"apiVersion": "2017-07-01",
|
|
||||||
"name": "[parameters('PlaybookName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"tags": {
|
|
||||||
"LogicAppsCategory": "security"
|
|
||||||
},
|
|
||||||
"dependsOn": [
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]"
|
|
||||||
],
|
|
||||||
"properties": {
|
|
||||||
"state": "Enabled",
|
|
||||||
"definition": {
|
|
||||||
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
|
|
||||||
"actions": {
|
|
||||||
"Alert_-_Get_incident": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/Incidents/subscriptions/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/resourceGroups/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/workspaces/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/alerts/@{encodeURIComponent(triggerBody()?['SystemAlertId'])}"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_Hosts": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/host"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Alert_-_Get_incident": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"For_each_Host": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>RiskIQ Reputation: @{items('For_each_Host')?['HostName']}.@{items('For_each_Host')?['DnsDomain']}<br>\nClassification: @{body('Get_reputation_for_host')?['classification']} (@{body('Get_reputation_for_host')?['score']})<br>\n@{body('Create_Host_HTML_table')}</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Create_Host_HTML_table": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Create_Host_HTML_table": {
|
|
||||||
"inputs": {
|
|
||||||
"format": "HTML",
|
|
||||||
"from": "@variables('result_output_host')"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Set_host_variable": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Table"
|
|
||||||
},
|
|
||||||
"Get_reputation_for_host": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/reputation",
|
|
||||||
"queries": {
|
|
||||||
"query": "@{items('For_each_Host')?['HostName']}.@{items('For_each_Host')?['DnsDomain']}"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Set_host_variable": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "result_output_host",
|
|
||||||
"value": "@body('Get_reputation_for_host')?['rules']"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Get_reputation_for_host": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "SetVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_Hosts')?['Hosts']",
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Result_Host": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Init_Result_Host": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "result_output_host",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_Hosts": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"outputs": {},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"defaultValue": {},
|
|
||||||
"type": "Object"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"triggers": {
|
|
||||||
"When_a_response_to_an_Azure_Sentinel_alert_is_triggered": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"callback_url": "@{listCallbackUrl()}"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"path": "/subscribe"
|
|
||||||
},
|
|
||||||
"type": "ApiConnectionWebhook"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"value": {
|
|
||||||
"azuresentinel": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]",
|
|
||||||
"connectionName": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
},
|
|
||||||
"riskiqpassivetotal": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"connectionName": "[variables('RiskIQConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}]
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
# Sentinel-Incident-Enrich-RiskIQ-Reputation-Summary-Domain
|
|
||||||
author: Brandon Dixon, RiskIQ
|
|
||||||
|
|
||||||
This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Azure Sentinel. You need a valid community or enterprise in order to use the connector and playbook. To learn more about the service and request a trial key, [register for free](https://community.riskiq.com/) or see the [API documentation](https://api.passivetotal.org/index.html).
|
|
||||||
|
|
||||||
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Reputation-Summary-Domain%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://aka.ms/deploytoazurebutton"/>
|
|
||||||
</a>
|
|
||||||
<a href="https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Reputation-Summary-Domain%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazuregov.png"/>
|
|
||||||
</a>
|
|
||||||
|
|
@ -1,224 +0,0 @@
|
||||||
{
|
|
||||||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"metadata": {
|
|
||||||
"comments": "Perform automated enrichment on the Azure Sentinel Incidents based on RiskIQ Reputation data.",
|
|
||||||
"author": "Brandon Dixon, RiskIQ"
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"PlaybookName": {
|
|
||||||
"defaultValue": "Sentinel-Incident-Enrich-RiskIQ-Reputation-Summary-IP",
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"UserName": {
|
|
||||||
"defaultValue": "<username>@<domain>",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"variables": {
|
|
||||||
"AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]",
|
|
||||||
"RiskIQConnectionName": "[concat('riskiqpassivetotal-', parameters('PlaybookName'))]"
|
|
||||||
},
|
|
||||||
"resources": [{
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('RiskIQConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Logic/workflows",
|
|
||||||
"apiVersion": "2017-07-01",
|
|
||||||
"name": "[parameters('PlaybookName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"tags": {
|
|
||||||
"LogicAppsCategory": "security"
|
|
||||||
},
|
|
||||||
"dependsOn": [
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]"
|
|
||||||
],
|
|
||||||
"properties": {
|
|
||||||
"state": "Enabled",
|
|
||||||
"definition": {
|
|
||||||
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
|
|
||||||
"actions": {
|
|
||||||
"Alert_-_Get_incident": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/Incidents/subscriptions/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/resourceGroups/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/workspaces/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/alerts/@{encodeURIComponent(triggerBody()?['SystemAlertId'])}"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Entities_-_Get_IPs": {
|
|
||||||
"inputs": {
|
|
||||||
"body": "@triggerBody()?['Entities']",
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/entities/ip"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Alert_-_Get_incident": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"For_each_IP_Address": {
|
|
||||||
"actions": {
|
|
||||||
"Add_comment_to_incident_(V3)_2": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
|
|
||||||
"message": "<p>RiskIQ Reputation: @{items('For_each_IP_Address')?['Address']}<br>\nClassification: @{body('Get_reputation')?['classification']} (@{body('Get_reputation')?['score']})<br>\n@{body('Create_IP_HTML_table')}</p>"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/Incidents/Comment"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Create_IP_HTML_table": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Create_IP_HTML_table": {
|
|
||||||
"inputs": {
|
|
||||||
"format": "HTML",
|
|
||||||
"from": "@variables('result_output_ip')"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Set_ip_variable": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Table"
|
|
||||||
},
|
|
||||||
"Get_reputation": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/reputation",
|
|
||||||
"queries": {
|
|
||||||
"query": "@items('For_each_IP_Address')?['Address']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Set_ip_variable": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "result_output_ip",
|
|
||||||
"value": "@body('Get_reputation')?['rules']"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Get_reputation": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "SetVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Entities_-_Get_IPs')?['IPs']",
|
|
||||||
"runAfter": {
|
|
||||||
"Init_Result_IP": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Init_Result_IP": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "result_output_ip",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Entities_-_Get_IPs": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"outputs": {},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"defaultValue": {},
|
|
||||||
"type": "Object"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"triggers": {
|
|
||||||
"When_a_response_to_an_Azure_Sentinel_alert_is_triggered": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"callback_url": "@{listCallbackUrl()}"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"path": "/subscribe"
|
|
||||||
},
|
|
||||||
"type": "ApiConnectionWebhook"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"value": {
|
|
||||||
"azuresentinel": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]",
|
|
||||||
"connectionName": "[variables('AzureSentinelConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
|
|
||||||
},
|
|
||||||
"riskiqpassivetotal": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"connectionName": "[variables('RiskIQConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}]
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
# Sentinel-Incident-Enrich-RiskIQ-Reputation-Summary-IP
|
|
||||||
author: Brandon Dixon, RiskIQ
|
|
||||||
|
|
||||||
This playbook uses the RiskIQ PassiveTotal connector to automatically enrich incidents generated by Azure Sentinel. You need a valid community or enterprise in order to use the connector and playbook. To learn more about the service and request a trial key, [register for free](https://community.riskiq.com/) or see the [API documentation](https://api.passivetotal.org/index.html).
|
|
||||||
|
|
||||||
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Reputation-Summary-IP%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://aka.ms/deploytoazurebutton"/>
|
|
||||||
</a>
|
|
||||||
<a href="https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Incident-Enrich-RiskIQ-Reputation-Summary-IP%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazuregov.png"/>
|
|
||||||
</a>
|
|
||||||
|
|
@ -1,340 +0,0 @@
|
||||||
{
|
|
||||||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"metadata": {
|
|
||||||
"comments": "Automatically bring RiskIQ Intelligence into Azure Sentinel via the Microsoft Security Graph.",
|
|
||||||
"author": "Brandon Dixon, RiskIQ"
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"PlaybookName": {
|
|
||||||
"defaultValue": "Sentinel-Intel-Action-RiskIQ-Intel-Article-Ingest",
|
|
||||||
"type": "string"
|
|
||||||
},
|
|
||||||
"UserName": {
|
|
||||||
"defaultValue": "<username>@<domain>",
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"variables": {
|
|
||||||
"MicrosoftGraphSecurityConnectionName": "[concat('microsoftgraphsecurity-', parameters('PlaybookName'))]",
|
|
||||||
"RiskIQConnectionName": "[concat('riskiqpassivetotal-', parameters('PlaybookName'))]"
|
|
||||||
},
|
|
||||||
"resources": [{
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('RiskIQConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Web/connections",
|
|
||||||
"apiVersion": "2016-06-01",
|
|
||||||
"name": "[variables('MicrosoftGraphSecurityConnectionName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"properties": {
|
|
||||||
"customParameterValues": {},
|
|
||||||
"api": {
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/microsoftgraphsecurity')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}, {
|
|
||||||
"type": "Microsoft.Logic/workflows",
|
|
||||||
"apiVersion": "2017-07-01",
|
|
||||||
"name": "[parameters('PlaybookName')]",
|
|
||||||
"location": "[resourceGroup().location]",
|
|
||||||
"tags": {
|
|
||||||
"LogicAppsCategory": "security"
|
|
||||||
},
|
|
||||||
"dependsOn": [
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"[resourceId('Microsoft.Web/connections', variables('MicrosoftGraphSecurityConnectionName'))]"
|
|
||||||
],
|
|
||||||
"properties": {
|
|
||||||
"state": "Enabled",
|
|
||||||
"definition": {
|
|
||||||
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
|
|
||||||
"actions": {
|
|
||||||
"For_each_indicator_type": {
|
|
||||||
"actions": {
|
|
||||||
"Switch": {
|
|
||||||
"cases": {
|
|
||||||
"Domain_Case": {
|
|
||||||
"actions": {
|
|
||||||
"For_each_domain": {
|
|
||||||
"actions": {
|
|
||||||
"Append_to_domains": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "domains",
|
|
||||||
"value": {
|
|
||||||
"action": "alert",
|
|
||||||
"additionalInformation": "@body('Get_article_details')?['link']",
|
|
||||||
"description": "@body('Get_article_details')?['title']",
|
|
||||||
"domainName": "@items('For_each_domain')",
|
|
||||||
"expirationDateTime": "@addDays(utcNow(), 30)",
|
|
||||||
"targetProduct": "Azure Sentinel",
|
|
||||||
"threatType": "WatchList",
|
|
||||||
"tlpLevel": "green"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "AppendToArrayVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@items('For_each_indicator_type')?['values']",
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Submit_multiple_domain_tiIndicators": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"value": "@variables('domains')"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['microsoftgraphsecurity']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/beta/security/tiIndicators/submitTiIndicators"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"For_each_domain": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"case": "domain"
|
|
||||||
},
|
|
||||||
"IP_Case": {
|
|
||||||
"actions": {
|
|
||||||
"For_each_ip": {
|
|
||||||
"actions": {
|
|
||||||
"Append_to_ip_addresses": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "ip",
|
|
||||||
"value": {
|
|
||||||
"action": "alert",
|
|
||||||
"additionalInformation": "@body('Get_article_details')?['link']",
|
|
||||||
"description": "@body('Get_article_details')?['title']",
|
|
||||||
"expirationDateTime": "@addDays(utcNow(), 30)",
|
|
||||||
"networkDestinationIPv4": "@items('For_each_ip')",
|
|
||||||
"targetProduct": "Azure Sentinel",
|
|
||||||
"threatType": "WatchList",
|
|
||||||
"tlpLevel": "green"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "AppendToArrayVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@items('For_each_indicator_type')?['values']",
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Submit_multiple_ip_tiIndicators": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"value": "@variables('ip')"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['microsoftgraphsecurity']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/beta/security/tiIndicators/submitTiIndicators"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"For_each_ip": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"case": "ip"
|
|
||||||
},
|
|
||||||
"URLs_Case": {
|
|
||||||
"actions": {
|
|
||||||
"For_each_url": {
|
|
||||||
"actions": {
|
|
||||||
"Append_to_urls": {
|
|
||||||
"inputs": {
|
|
||||||
"name": "urls",
|
|
||||||
"value": {
|
|
||||||
"action": "alert",
|
|
||||||
"additionalInformation": "@body('Get_article_details')?['link']",
|
|
||||||
"description": "@body('Get_article_details')?['title']",
|
|
||||||
"expirationDateTime": "@addDays(utcNow(), 30)",
|
|
||||||
"targetProduct": "Azure Sentinel",
|
|
||||||
"threatType": "WatchList",
|
|
||||||
"tlpLevel": "green",
|
|
||||||
"url": "@items('For_each_url')"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "AppendToArrayVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@items('For_each_indicator_type')?['values']",
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Submit_multiple_url_tiIndicators": {
|
|
||||||
"inputs": {
|
|
||||||
"body": {
|
|
||||||
"value": "@variables('urls')"
|
|
||||||
},
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['microsoftgraphsecurity']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "post",
|
|
||||||
"path": "/beta/security/tiIndicators/submitTiIndicators"
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"For_each_url": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"case": "url"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"default": {
|
|
||||||
"actions": {}
|
|
||||||
},
|
|
||||||
"expression": "@items('For_each_indicator_type')?['type']",
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "Switch"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"foreach": "@body('Get_article_details')?['indicators']",
|
|
||||||
"runAfter": {
|
|
||||||
"Init_domains": [
|
|
||||||
"Succeeded"
|
|
||||||
],
|
|
||||||
"Init_ip_addresses": [
|
|
||||||
"Succeeded"
|
|
||||||
],
|
|
||||||
"Init_urls": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "Foreach"
|
|
||||||
},
|
|
||||||
"Get_article_details": {
|
|
||||||
"inputs": {
|
|
||||||
"host": {
|
|
||||||
"connection": {
|
|
||||||
"name": "@parameters('$connections')['riskiqpassivetotal']['connectionId']"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"method": "get",
|
|
||||||
"path": "/articles/@{encodeURIComponent(triggerBody()?['guid'])}"
|
|
||||||
},
|
|
||||||
"runAfter": {},
|
|
||||||
"type": "ApiConnection"
|
|
||||||
},
|
|
||||||
"Init_domains": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "domains",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Get_article_details": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
},
|
|
||||||
"Init_ip_addresses": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "ip",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Get_article_details": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
},
|
|
||||||
"Init_urls": {
|
|
||||||
"inputs": {
|
|
||||||
"variables": [
|
|
||||||
{
|
|
||||||
"name": "urls",
|
|
||||||
"type": "array"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"runAfter": {
|
|
||||||
"Get_article_details": [
|
|
||||||
"Succeeded"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"type": "InitializeVariable"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"contentVersion": "1.0.0.0",
|
|
||||||
"outputs": {},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"defaultValue": {},
|
|
||||||
"type": "Object"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"triggers": {
|
|
||||||
"manual": {
|
|
||||||
"inputs": {
|
|
||||||
"schema": {
|
|
||||||
"properties": {
|
|
||||||
"guid": {
|
|
||||||
"type": "string"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"type": "object"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"kind": "Http",
|
|
||||||
"type": "Request"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"parameters": {
|
|
||||||
"$connections": {
|
|
||||||
"value": {
|
|
||||||
"microsoftgraphsecurity": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('MicrosoftGraphSecurityConnectionName'))]",
|
|
||||||
"connectionName": "[variables('MicrosoftGraphSecurityConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/microsoftgraphsecurity')]"
|
|
||||||
},
|
|
||||||
"riskiqpassivetotal": {
|
|
||||||
"connectionId": "[resourceId('Microsoft.Web/connections', variables('RiskIQConnectionName'))]",
|
|
||||||
"connectionName": "[variables('RiskIQConnectionName')]",
|
|
||||||
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/riskiqpassivetotal')]"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}]
|
|
||||||
}
|
|
||||||
|
|
@ -1,11 +0,0 @@
|
||||||
# Sentinel-Intel-Action-RiskIQ-Intel-Article-Ingest
|
|
||||||
author: Brandon Dixon, RiskIQ
|
|
||||||
|
|
||||||
This playbook will populate the Microsoft Security Graph for Azure Sentinel with indicators from RiskIQ articles. You need a valid community or enterprise in order to use the connector and playbook. To learn more about the service and request a trial key, [register for free](https://community.riskiq.com/) or see the [API documentation](https://api.passivetotal.org/index.html).
|
|
||||||
|
|
||||||
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Intel-Action-RiskIQ-Intel-Article-Ingest%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://aka.ms/deploytoazurebutton"/>
|
|
||||||
</a>
|
|
||||||
<a href="https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FSentinel-Intel-Action-RiskIQ-Intel-Article-Ingest%2Fazuredeploy.json" target="_blank">
|
|
||||||
<img src="https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazuregov.png"/>
|
|
||||||
</a>
|
|
||||||
Загрузка…
Ссылка в новой задаче