Azure-Sentinel/Playbooks/Get-GeoFromIPandTagIncident-EmailAlertBasedonGeo

Author: Rudi Jubran

Based on original playbook by: Nicholas DiCola (Get-GeoFromIPAndTagIncident)

This playbook will take the IP address entities from the Incident and query a Geo-IP API to geo-locate the IP Address. It will then write the City, Country, and Account entites to tags on the Incident. Then, these tags are compared to a user-defined condition, and unexpected City/Country/User become alerts. Expected incidents are closed.

In summary, according to Incident tags, the playbook will either:

1. Close the incident (If incident matches expected country/city/user)
2. Set the Incident to "In Progress", and email an alert containing the user, IP, geo tag and timestamp. (If incident does not match defined country/city/user)

Configure the following via Logic App Designer:

Define expected tags:

Define "to" address for alerts: