Azure-Sentinel/Playbooks/Enrich-Sentinel-Incident-AlienVault-OTX

Enrich-Sentinel-Incident-AlienVault-OTX

author: Brian Delaney

This playbook will enrich a Sentinel Incident with pulse information from AlienVault OTX. If any pulses are found the Incident will also be tagged and the severity raised to High.

The following entity types will be enriched with this playbook:

• IP
• URL
• File hash
• DNS

Quick Deployment

After deployment, attach this playbook to an automation rule so it runs when the incident is created.

Learn more about automation rules

Prerequisites

• After deploying the the playbook you will need to grant the playbook's Managed Identity Azure Sentinel Responder (or greater) access to the resource group where Azure Sentinel is installed. This gives the Managed Identity the necessary permissions to add comments, tags, and change incident severity.

Screenshots