История

jingsta 3b351e1243 Updated template to meet checks		2021-07-20 09:18:24 -05:00
..
Media	Migrated playbook to support incidents instead of alerts. fixed some JSON parsing problems with adaptive cards by adding an compose action to render the card.	2021-07-19 16:08:45 -05:00
images	Migrated playbook to support incidents instead of alerts. fixed some JSON parsing problems with adaptive cards by adding an compose action to render the card.	2021-07-19 16:08:45 -05:00
README.md	Resolved conflicts on readme	2021-07-19 16:16:46 -05:00
azuredeploy.json	Updated template to meet checks	2021-07-20 09:18:24 -05:00
parametersFile.json	updated template	2021-07-19 16:38:52 -05:00

Advanced - ServiceNow & Teams Integration

Author: Jing Nghik

This arm template will deploy multiple logic app playbooks and api connectors.

(Main playbook) <playbookName>-workflow-incident
(playbook function) - <playbookName>-function-getListOfTaggedPlaybooks This playbooks purpose is to locate any playbooks that have been tagged with playbook to populate the Investigation Response list dynamically.
(Check IP - Example playbook) - <playbookName>-checkIPOnVirusTotal - Simple playbook to check IP on VirusTotal. This playbook is an example that will be available in Azure Sentinel and the main playbook.
All the API connectors are reused across the same playbook to prevent duplicate API connectors created.

Updates

Migrated playbook to support incidents instead of alerts
fixed some JSON parsing problems with adaptive cards by adding an compose action to render the card.

Video Walkthrough

In order to fully utilize this playbook. There are a number of pre-configuration steps required before deploying the Logic App.

You will need the following:

ServiceNow instance URL, Username, and password You can create a dev environment to test with for free at https://developer.servicenow.com/dev.do
access/authorization to enable api connectors for Azure resource manager, teams, and azure sentinel.
Teams Group ID, Alert Channel ID, Investigation Response Channel ID The group ID and Channel ID can be obtained by going to Teams and getting the link which has the values you need for the parameters. (Will need to URL decode it if there are special characters). URL Decoder Link
Investigation Channel ID can also use the same ID as alert channel if desired.

Based on the rules, Azure Sentinel triggers an incident or alert.
This runs a linked playbook that first will check to determine if an existing serviceNow ticket already exists with the same incident ID (to prevent duplicate tickets)
The ticket is opened in serviceNow and a Teams message is created in the Alerts channel with alert/incident details.
A corresponding investigation response message is sent with a list of available playbooks that can be run from teams.
Based on selected playbooks submitted, the playbooks are ran ad-hoc by routing the alert body to the selected playbook.
If the executed playbook returns a response, that message is updated in the related serviceNow ticket, commented in the Azure Sentinel Incident, and also added added as a reply to the Initial Teams Alert message.

Click Deploy to Azure and fill in parameters
Populate the Teams Group and Channel IDs to ensure it messages are generated in the right channel.
Search for API connectors and find the deployment prefix and fix any connectors by authorizing the connection.
Manually trigger an azure sentinel alert to test.

Thank you to the following people for contributing to my efforts in building this playbook!

Twitter @thijslecomte - For showing me how to make my first template!
Jan Ignacio, Joey Cruz, Sreedhar Ande, Nicholas Dicola, Rod Trent, Nathan Swift for pushing me to contribute to this repo, testing, and feedback.