Azure-Sentinel/Playbooks/Get-GeoFromIpAndTagIncident
v-amolpatil 79308d0fef
Get-GeoFromIpAndTagIncident Playbook Issue fix (#7513)
* updated code

* updated code as per review comment
2023-03-09 11:02:51 +05:30
..
alert-trigger Update playbook trigger names 2022-02-22 17:02:56 +02:00
customConnector Get-GeoFromIpAndTagIncident Playbook Issue fix (#7513) 2023-03-09 11:02:51 +05:30
incident-trigger Get-GeoFromIpAndTagIncident Playbook Issue fix (#7513) 2023-03-09 11:02:51 +05:30
readme.md Update Get-GeoFromIpAndTagIncident 2021-07-16 17:31:19 +00:00

readme.md

Get-GeoFromIpAndTagIncident

author: Nicholas DiCola

This playbook will take the IP address entities from the Incident and query a Geo-IP API to geo-locate the IP Address. It will write the City and Country to a tag on the Incident and more details to the comments.

Custom Connector

This playbook uses a custom connector in Logic Apps.

If you want to deploy just the customer connector:

Deploy to Azure Deploy to Azure Gov

Quick Deployment

Deploy with incident trigger (recommended)

After deployment, attach this playbook to an automation rule so it runs when the incident is created.

Learn more about automation rules

Deploy to Azure Deploy to Azure Gov

Deploy with alert trigger

After deployment, you can run this playbook manually on an alert or attach it to an analytics rule so it will rune when an alert is created.

Deploy to Azure Deploy to Azure Gov

Prerequisites

None

Screenshots

Incident Trigger
Incident Trigger
Alert Trigger
Alert Trigger