Azure-Sentinel/Playbooks/Unisolate-MDE-Machine-entityTrigger

Unisolate-MDE-Machine-entityTrigger

author: Benji Kovacevic

This playbook will unisolate Microsoft Defender for Endpoint (MDE) device using entity trigger.

Prerequisites

None.

Quick Deployment

Post-deployment

1. Assign Microsoft Sentinel Responder role to the managed identity. To do so, choose Identity blade under Settings of the Logic App.
2. Assign User.ReadWrite.All and Directory.ReadWrite.All API permissions to the managed identity.
   

$MIGuid = "<Enter your managed identity guid here>"
$MI = Get-AzureADServicePrincipal -ObjectId $MIGuid

$GraphAppId = "fc780465-2017-40d4-a0c5-307022471b92"
$PermissionName1 = "Machine.Isolate"

$GraphServicePrincipal = Get-AzureADServicePrincipal -Filter "appId eq '$GraphAppId'"
$AppRole1 = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionName1 -and $_.AllowedMemberTypes -contains "Application"}
New-AzureAdServiceAppRoleAssignment -ObjectId $MI.ObjectId -PrincipalId $MI.ObjectId `
-ResourceId $GraphServicePrincipal.ObjectId -Id $AppRole1.Id

Screenshots

Playbook