Azure
/
Azure-Sentinel
зеркало из
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность
Azure-Sentinel/Playbooks/Get-VirusTotalIPReport
История
dicolanl 5f22f5bacc Update Get-VirusTotalURLReport 
adjusted name
added folder structure
images
 		2021-06-08 18:49:58 +00:00
..
alert-trigger Update Get-IPRepuation 2021-06-04 00:20:26 +00:00
incident-trigger Update Get-VirusTotalURLReport 2021-06-08 18:49:58 +00:00
readme.md Update Get-IPRepuation 2021-06-04 00:20:26 +00:00

readme.md

Get-VirusTotalIPReport

author: Nicholas DiCola

This playbook will take each IP entity and query VirusTotal for IP Address Report (https://developers.virustotal.com/v3.0/reference#ip-info). It will write the results to Log Analytics and add a comment to the incident.

Quick Deployment

Deploy with incident trigger (recommended)

After deployment, attach this playbook to an automation rule so it runs when the incident is created.

Learn more about automation rules

Deploy with alert trigger

After deployment, you can run this playbook manually on an alert or attach it to an analytics rule so it will rune when an alert is created.

Prerequisites

  • You will need to register to Virus Total community for an API key

Screenshots

Incident Trigger
Incident Trigger
Alert Trigger
Alert Trigger