Azure-Sentinel/Playbooks/Enrich-MalwareBazaar

Enrich-MalwareBazaar

Add information from MalwareBazaar aka abuse.ch to a Sentinel Incident

Quick Deployment

Deploy with incident trigger (recommended)

After deployment, attach this playbook to an automation rule so it runs when the incident is created.

Learn more about automation rules

Prerequisites

• API key is not required for malwarebazaar
• Logic Apps Custom Connector for MalwareBazaar
• Logic App managed identity should be given Sentinel Responder role to read incident trigger and write comment/tag to incident

Screenshots

Workflow explained

(step by step pseudo-code)

1. Sentinel incident trigger
2. Get FileHashes entities
3. Validate that entities list is not empty or terminate
4. For each FileHashes, do a malwarebazaar query and append output to comment
5. Update sentinel incident with comment and appropriate tag Found/NotFound