[^=;]+)\", dynamic([\"key\",\"value\"]), AEcopy)\n| mv-apply AEcopy on (\n summarize AdditionalExtensionsParsedNested = make_bag(bag_pack(tostring(AEcopy[0]), AEcopy[1]))\n)\n| extend AdditionalExtensionsParsed = AdditionalExtensionsParsedNested\n| evaluate bag_unpack(AdditionalExtensionsParsed)\n| extend ThreatLevel_Score = toint(column_ifexists(\"InfobloxThreatLevel\", \"\"))\n| extend ThreatLevel = case(ThreatLevel_Score>=80, \"High\",\n ThreatLevel_Score>=30 and ThreatLevel_Score<80, \"Medium\",\n ThreatLevel_Score<30 and ThreatLevel_Score>=1, \"Low\",\n ThreatLevel_Score == 0,\"Info\",\n \"N/A\" )\n| extend ThreatClass = extract(\"(.*?)_\", 1, tostring(column_ifexists(\"InfobloxThreatProperty\", \"\")))\n| extend ThreatProperty = extract(\"([^_]*$)\", 1, tostring(column_ifexists(\"InfobloxThreatProperty\", \"\")))\n| extend InfobloxB1FeedName = column_ifexists(\"InfobloxB1FeedName\", \"\")\n| extend InfobloxRPZ = column_ifexists(\"InfobloxRPZ\", \"\")\n| extend InfobloxB1PolicyAction = column_ifexists(\"InfobloxB1PolicyAction\", \"\")\n| extend InfobloxB1PolicyName = column_ifexists(\"InfobloxB1PolicyName\", \"\")\n| extend InfobloxDomainCat = column_ifexists(\"InfobloxDomainCat\", \"\")\n| extend InfobloxB1ConnectionType = column_ifexists(\"InfobloxB1ConnectionType\", \"\")\n| extend InfobloxB1SrcOSVersion = column_ifexists(\"InfobloxB1SrcOSVersion\", \"\")\n| extend InfobloxB1Network = column_ifexists(\"InfobloxB1Network\", \"\")\n| extend DeviceName = column_ifexists(\"DeviceName\", \"\")\n| extend SourceMACAddress = column_ifexists(\"SourceMACAddress\", \"\")\n| extend InfobloxLeaseOp = column_ifexists(\"InfobloxLeaseOp\", \"\")\n| extend InfobloxLifetime = column_ifexists(\"InfobloxLifetime\", \"\")\n| extend InfobloxLeaseUUID = column_ifexists(\"InfobloxLeaseUUID\", \"\")\n| extend InfobloxDNSRCode = column_ifexists(\"InfobloxDNSRCode\", \"\")\n| extend InfobloxDNSQClass = column_ifexists(\"InfobloxDNSQClass\", \"\")\n| extend InfobloxDNSQType = column_ifexists(\"InfobloxDNSQType\", \"\")\n| extend InfobloxThreatConfidence = toint(column_ifexists(\"InfobloxThreatConfidence\", \"\"))\n| extend ThreatConfidence = toint(column_ifexists(\"InfobloxThreatConfidence\", \"\"))\n",
+ "functionParameters": "",
+ "version": 2,
+ "tags": [
+ {
+ "name": "description",
+ "value": ""
+ }
+ ]
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "location": "[parameters('workspace-location')]",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]",
+ "dependsOn": [
+ "[variables('_parserId1')]"
+ ],
+ "properties": {
+ "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]",
+ "contentId": "[variables('_parserContentId1')]",
+ "kind": "Parser",
+ "version": "[variables('parserVersion1')]",
+ "source": {
+ "kind": "Solution",
+ "name": "Infoblox Cloud Data Connector",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Infoblox",
+ "tier": "Partner",
+ "link": "https://support.infoblox.com/"
+ }
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('playbookTemplateSpecName1')]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "Infoblox-Import-AISCOMM-Weekly Playbook with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('playbookVersion1')]",
+ "parameters": {
+ "PlaybookName": {
+ "defaultValue": "Infoblox-Import-AISCOMM-Weekly",
+ "type": "string"
+ },
+ "AD Application Secret": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for AD Application Secret"
+ }
+ },
+ "Client ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Client ID"
+ }
+ },
+ "TIDE API Key": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for TIDE API Key"
+ }
+ },
+ "Tenant ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Tenant ID"
+ }
+ }
+ },
+ "variables": {
+ "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]",
+ "workspace-name": "[parameters('workspace')]",
+ "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]"
+ },
+ "resources": [
+ {
+ "properties": {
+ "provisioningState": "Succeeded",
+ "state": "Disabled",
+ "definition": {
+ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "AD Application Secret": {
+ "defaultValue": "[[parameters('AD Application Secret')]",
+ "type": "string"
+ },
+ "Client ID": {
+ "defaultValue": "[[parameters('Client ID')]",
+ "type": "string"
+ },
+ "TIDE API Key": {
+ "defaultValue": "[[parameters('TIDE API Key')]",
+ "type": "string"
+ },
+ "Tenant ID": {
+ "defaultValue": "[[parameters('Tenant ID')]",
+ "type": "string"
+ }
+ },
+ "triggers": {
+ "Recurrence": {
+ "recurrence": {
+ "frequency": "Week",
+ "interval": 1
+ },
+ "evaluatedRecurrence": {
+ "frequency": "Week",
+ "interval": 1
+ },
+ "type": "Recurrence"
+ }
+ },
+ "actions": {
+ "For_Each_Indicator_(Threat)": {
+ "foreach": "@body('Parse_JSON')?['threat']",
+ "actions": {
+ "Switch": {
+ "cases": {
+ "EMAIL": {
+ "case": "EMAIL",
+ "actions": {
+ "Send_Emails_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}",
+ "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HASH": {
+ "case": "HASH",
+ "actions": {
+ "Send_Hashes_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "fileHashType": "@{toLower(items('For_Each_Indicator_(Threat)')?['hash_type'])}",
+ "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}",
+ "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HOST": {
+ "case": "HOST",
+ "actions": {
+ "Send_Hosts_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "IP": {
+ "case": "IP",
+ "actions": {
+ "Send_IPs_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "URL": {
+ "case": "URL",
+ "actions": {
+ "Send_URLs_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white",
+ "url": "@{items('For_Each_Indicator_(Threat)')?['url']}"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ }
+ },
+ "expression": "@items('For_Each_Indicator_(Threat)')?['type']",
+ "type": "Switch"
+ }
+ },
+ "runAfter": {
+ "Parse_JSON": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "Get_TIDE_Data": {
+ "type": "Http",
+ "inputs": {
+ "headers": {
+ "Authorization": "Token @{parameters('TIDE API Key')}"
+ },
+ "method": "GET",
+ "queries": {
+ "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url",
+ "profile": "AISCOMM",
+ "rlimit": "90000"
+ },
+ "uri": "https://csp.infoblox.com/tide/api/data/threats/"
+ }
+ },
+ "Parse_JSON": {
+ "runAfter": {
+ "Get_TIDE_Data": [
+ "Succeeded"
+ ]
+ },
+ "type": "ParseJson",
+ "inputs": {
+ "content": "@body('Get_TIDE_Data')",
+ "schema": {
+ "properties": {
+ "record_count": {
+ "type": "integer"
+ },
+ "threat": {
+ "items": {
+ "properties": {
+ "batch_id": {
+ "type": "string"
+ },
+ "class": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "integer"
+ },
+ "confidence_score": {
+ "type": "number"
+ },
+ "confidence_score_rating": {
+ "type": "string"
+ },
+ "confidence_score_vector": {
+ "type": "string"
+ },
+ "detected": {
+ "type": "string"
+ },
+ "domain": {
+ "type": "string"
+ },
+ "email": {
+ "type": "string"
+ },
+ "expiration": {
+ "type": "string"
+ },
+ "extended": {
+ "properties": {
+ "ais_consent": {
+ "type": "string"
+ },
+ "cyberint_guid": {
+ "type": "string"
+ },
+ "no_whitelist": {
+ "type": "string"
+ },
+ "notes": {
+ "type": "string"
+ },
+ "protocol": {
+ "type": "string"
+ },
+ "url_hash": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "hash": {
+ "type": "string"
+ },
+ "hash_type": {
+ "type": "string"
+ },
+ "host": {
+ "type": "string"
+ },
+ "id": {
+ "type": "string"
+ },
+ "imported": {
+ "type": "string"
+ },
+ "ip": {
+ "type": "string"
+ },
+ "profile": {
+ "type": "string"
+ },
+ "property": {
+ "type": "string"
+ },
+ "received": {
+ "type": "string"
+ },
+ "risk_score": {
+ "type": "number"
+ },
+ "risk_score_rating": {
+ "type": "string"
+ },
+ "risk_score_vector": {
+ "type": "string"
+ },
+ "threat_level": {
+ "type": "integer"
+ },
+ "threat_score": {
+ "type": "number"
+ },
+ "threat_score_rating": {
+ "type": "string"
+ },
+ "threat_score_vector": {
+ "type": "string"
+ },
+ "tld": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ },
+ "url": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "id"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ }
+ }
+ }
+ }
+ }
+ },
+ "name": "[[parameters('PlaybookName')]",
+ "type": "Microsoft.Logic/workflows",
+ "location": "[[variables('workspace-location-inline')]",
+ "tags": {
+ "hidden-SentinelTemplateName": "Infoblox-Import-AISCOMM-Weekly",
+ "hidden-SentinelTemplateVersion": "1.0",
+ "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]"
+ },
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "apiVersion": "2017-07-01",
+ "dependsOn": "[variables('TemplateEmptyArray')]"
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId1'),'/'))))]",
+ "properties": {
+ "parentId": "[variables('playbookId1')]",
+ "contentId": "[variables('_playbookContentId1')]",
+ "kind": "Playbook",
+ "version": "[variables('playbookVersion1')]",
+ "source": {
+ "kind": "Solution",
+ "name": "Infoblox Cloud Data Connector",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Infoblox",
+ "tier": "Partner",
+ "link": "https://support.infoblox.com/"
+ }
+ }
+ }
+ ],
+ "metadata": {
+ "title": "Infoblox Import AISCOMM Weekly",
+ "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports all indicators from the AISCOMM data provider on a scheduled weekly basis.",
+ "prerequisites": [
+ "Infoblox TIDE API key."
+ ],
+ "postDeployment": [
+ "Authorize connections."
+ ],
+ "lastUpdateTime": "2023-08-07T00:00:00Z",
+ "releaseNotes": {
+ "version": "1.0",
+ "title": "[variables('blanks')]",
+ "notes": [
+ "Initial version"
+ ]
+ }
+ }
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('_playbookContentId1')]",
+ "contentKind": "Playbook",
+ "displayName": "Infoblox-Import-AISCOMM-Weekly",
+ "contentProductId": "[variables('_playbookcontentProductId1')]",
+ "id": "[variables('_playbookcontentProductId1')]",
+ "version": "[variables('playbookVersion1')]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('playbookTemplateSpecName2')]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "Infoblox-Import-Emails-Weekly Playbook with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('playbookVersion2')]",
+ "parameters": {
+ "PlaybookName": {
+ "defaultValue": "Infoblox-Import-Emails-Weekly",
+ "type": "string"
+ },
+ "AD Application Secret": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for AD Application Secret"
+ }
+ },
+ "Client ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Client ID"
+ }
+ },
+ "TIDE API Key": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for TIDE API Key"
+ }
+ },
+ "Tenant ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Tenant ID"
+ }
+ }
+ },
+ "variables": {
+ "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]",
+ "workspace-name": "[parameters('workspace')]",
+ "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]"
+ },
+ "resources": [
+ {
+ "properties": {
+ "provisioningState": "Succeeded",
+ "state": "Disabled",
+ "definition": {
+ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "AD Application Secret": {
+ "defaultValue": "[[parameters('AD Application Secret')]",
+ "type": "string"
+ },
+ "Client ID": {
+ "defaultValue": "[[parameters('Client ID')]",
+ "type": "string"
+ },
+ "TIDE API Key": {
+ "defaultValue": "[[parameters('TIDE API Key')]",
+ "type": "string"
+ },
+ "Tenant ID": {
+ "defaultValue": "[[parameters('Tenant ID')]",
+ "type": "string"
+ }
+ },
+ "triggers": {
+ "Recurrence": {
+ "recurrence": {
+ "frequency": "Week",
+ "interval": 1
+ },
+ "evaluatedRecurrence": {
+ "frequency": "Week",
+ "interval": 1
+ },
+ "type": "Recurrence"
+ }
+ },
+ "actions": {
+ "For_Each_Indicator_(Threat)": {
+ "foreach": "@body('Parse_JSON')?['threat']",
+ "actions": {
+ "Switch": {
+ "cases": {
+ "EMAIL": {
+ "case": "EMAIL",
+ "actions": {
+ "Send_Emails_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}",
+ "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HASH": {
+ "case": "HASH",
+ "actions": {
+ "Send_Hashes_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}",
+ "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}",
+ "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HOST": {
+ "case": "HOST",
+ "actions": {
+ "Send_Hosts_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "IP": {
+ "case": "IP",
+ "actions": {
+ "Send_IPs_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "URL": {
+ "case": "URL",
+ "actions": {
+ "Send_URLs_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white",
+ "url": "@{items('For_Each_Indicator_(Threat)')?['url']}"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ }
+ },
+ "expression": "@items('For_Each_Indicator_(Threat)')?['type']",
+ "type": "Switch"
+ }
+ },
+ "runAfter": {
+ "Parse_JSON": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "Get_TIDE_Data": {
+ "type": "Http",
+ "inputs": {
+ "headers": {
+ "Authorization": "Token @{parameters('TIDE API Key')}"
+ },
+ "method": "GET",
+ "queries": {
+ "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url",
+ "rlimit": "90000"
+ },
+ "uri": "https://csp.infoblox.com/tide/api/data/threats/email/"
+ }
+ },
+ "Parse_JSON": {
+ "runAfter": {
+ "Get_TIDE_Data": [
+ "Succeeded"
+ ]
+ },
+ "type": "ParseJson",
+ "inputs": {
+ "content": "@body('Get_TIDE_Data')",
+ "schema": {
+ "properties": {
+ "record_count": {
+ "type": "integer"
+ },
+ "threat": {
+ "items": {
+ "properties": {
+ "batch_id": {
+ "type": "string"
+ },
+ "class": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "integer"
+ },
+ "confidence_score": {
+ "type": "number"
+ },
+ "confidence_score_rating": {
+ "type": "string"
+ },
+ "confidence_score_vector": {
+ "type": "string"
+ },
+ "detected": {
+ "type": "string"
+ },
+ "domain": {
+ "type": "string"
+ },
+ "email": {
+ "type": "string"
+ },
+ "expiration": {
+ "type": "string"
+ },
+ "extended": {
+ "properties": {
+ "ais_consent": {
+ "type": "string"
+ },
+ "cyberint_guid": {
+ "type": "string"
+ },
+ "no_whitelist": {
+ "type": "string"
+ },
+ "notes": {
+ "type": "string"
+ },
+ "protocol": {
+ "type": "string"
+ },
+ "url_hash": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "hash": {
+ "type": "string"
+ },
+ "hash_type": {
+ "type": "string"
+ },
+ "host": {
+ "type": "string"
+ },
+ "id": {
+ "type": "string"
+ },
+ "imported": {
+ "type": "string"
+ },
+ "ip": {
+ "type": "string"
+ },
+ "profile": {
+ "type": "string"
+ },
+ "property": {
+ "type": "string"
+ },
+ "received": {
+ "type": "string"
+ },
+ "risk_score": {
+ "type": "number"
+ },
+ "risk_score_rating": {
+ "type": "string"
+ },
+ "risk_score_vector": {
+ "type": "string"
+ },
+ "threat_level": {
+ "type": "integer"
+ },
+ "threat_score": {
+ "type": "number"
+ },
+ "threat_score_rating": {
+ "type": "string"
+ },
+ "threat_score_vector": {
+ "type": "string"
+ },
+ "tld": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ },
+ "url": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "id"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ }
+ }
+ }
+ }
+ }
+ },
+ "name": "[[parameters('PlaybookName')]",
+ "type": "Microsoft.Logic/workflows",
+ "location": "[[variables('workspace-location-inline')]",
+ "tags": {
+ "hidden-SentinelTemplateName": "Infoblox-Import-Emails-Weekly",
+ "hidden-SentinelTemplateVersion": "1.0",
+ "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]"
+ },
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "apiVersion": "2017-07-01",
+ "dependsOn": "[variables('TemplateEmptyArray')]"
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId2'),'/'))))]",
+ "properties": {
+ "parentId": "[variables('playbookId2')]",
+ "contentId": "[variables('_playbookContentId2')]",
+ "kind": "Playbook",
+ "version": "[variables('playbookVersion2')]",
+ "source": {
+ "kind": "Solution",
+ "name": "Infoblox Cloud Data Connector",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Infoblox",
+ "tier": "Partner",
+ "link": "https://support.infoblox.com/"
+ }
+ }
+ }
+ ],
+ "metadata": {
+ "title": "Infoblox Import Emails Weekly",
+ "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected emails on a scheduled weekly basis.",
+ "prerequisites": [
+ "Infoblox TIDE API key."
+ ],
+ "postDeployment": [
+ "Authorize connections."
+ ],
+ "lastUpdateTime": "2023-08-07T00:00:00Z",
+ "releaseNotes": {
+ "version": "1.0",
+ "title": "[variables('blanks')]",
+ "notes": [
+ "Initial version"
+ ]
+ }
+ }
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('_playbookContentId2')]",
+ "contentKind": "Playbook",
+ "displayName": "Infoblox-Import-Emails-Weekly",
+ "contentProductId": "[variables('_playbookcontentProductId2')]",
+ "id": "[variables('_playbookcontentProductId2')]",
+ "version": "[variables('playbookVersion2')]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('playbookTemplateSpecName3')]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "Infoblox-Import-Hashes-Weekly Playbook with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('playbookVersion3')]",
+ "parameters": {
+ "PlaybookName": {
+ "defaultValue": "Infoblox-Import-Hashes-Weekly",
+ "type": "string"
+ },
+ "AD Application Secret": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for AD Application Secret"
+ }
+ },
+ "Client ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Client ID"
+ }
+ },
+ "TIDE API Key": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for TIDE API Key"
+ }
+ },
+ "Tenant ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Tenant ID"
+ }
+ }
+ },
+ "variables": {
+ "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]",
+ "workspace-name": "[parameters('workspace')]",
+ "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]"
+ },
+ "resources": [
+ {
+ "properties": {
+ "provisioningState": "Succeeded",
+ "state": "Disabled",
+ "definition": {
+ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "AD Application Secret": {
+ "defaultValue": "[[parameters('AD Application Secret')]",
+ "type": "string"
+ },
+ "Client ID": {
+ "defaultValue": "[[parameters('Client ID')]",
+ "type": "string"
+ },
+ "TIDE API Key": {
+ "defaultValue": "[[parameters('TIDE API Key')]",
+ "type": "string"
+ },
+ "Tenant ID": {
+ "defaultValue": "[[parameters('Tenant ID')]",
+ "type": "string"
+ }
+ },
+ "triggers": {
+ "Recurrence": {
+ "recurrence": {
+ "frequency": "Week",
+ "interval": 1
+ },
+ "evaluatedRecurrence": {
+ "frequency": "Week",
+ "interval": 1
+ },
+ "type": "Recurrence"
+ }
+ },
+ "actions": {
+ "For_Each_Indicator_(Threat)": {
+ "foreach": "@body('Parse_JSON')?['threat']",
+ "actions": {
+ "Switch": {
+ "cases": {
+ "EMAIL": {
+ "case": "EMAIL",
+ "actions": {
+ "Send_Emails_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}",
+ "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HASH": {
+ "case": "HASH",
+ "actions": {
+ "Send_Hashes_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "fileHashType": "@{toLower(items('For_Each_Indicator_(Threat)')?['hash_type'])}",
+ "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}",
+ "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HOST": {
+ "case": "HOST",
+ "actions": {
+ "Send_Hosts_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "IP": {
+ "case": "IP",
+ "actions": {
+ "Send_IPs_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "URL": {
+ "case": "URL",
+ "actions": {
+ "Send_URLs_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white",
+ "url": "@{items('For_Each_Indicator_(Threat)')?['url']}"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ }
+ },
+ "expression": "@items('For_Each_Indicator_(Threat)')?['type']",
+ "type": "Switch"
+ }
+ },
+ "runAfter": {
+ "Parse_JSON": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "Get_TIDE_Data": {
+ "type": "Http",
+ "inputs": {
+ "headers": {
+ "Authorization": "Token @{parameters('TIDE API Key')}"
+ },
+ "method": "GET",
+ "queries": {
+ "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url",
+ "rlimit": "90000"
+ },
+ "uri": "https://csp.infoblox.com/tide/api/data/threats/hash/weekly"
+ }
+ },
+ "Parse_JSON": {
+ "runAfter": {
+ "Get_TIDE_Data": [
+ "Succeeded"
+ ]
+ },
+ "type": "ParseJson",
+ "inputs": {
+ "content": "@body('Get_TIDE_Data')",
+ "schema": {
+ "properties": {
+ "record_count": {
+ "type": "integer"
+ },
+ "threat": {
+ "items": {
+ "properties": {
+ "batch_id": {
+ "type": "string"
+ },
+ "class": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "integer"
+ },
+ "confidence_score": {
+ "type": "number"
+ },
+ "confidence_score_rating": {
+ "type": "string"
+ },
+ "confidence_score_vector": {
+ "type": "string"
+ },
+ "detected": {
+ "type": "string"
+ },
+ "domain": {
+ "type": "string"
+ },
+ "email": {
+ "type": "string"
+ },
+ "expiration": {
+ "type": "string"
+ },
+ "extended": {
+ "properties": {
+ "ais_consent": {
+ "type": "string"
+ },
+ "cyberint_guid": {
+ "type": "string"
+ },
+ "no_whitelist": {
+ "type": "string"
+ },
+ "notes": {
+ "type": "string"
+ },
+ "protocol": {
+ "type": "string"
+ },
+ "url_hash": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "hash": {
+ "type": "string"
+ },
+ "hash_type": {
+ "type": "string"
+ },
+ "host": {
+ "type": "string"
+ },
+ "id": {
+ "type": "string"
+ },
+ "imported": {
+ "type": "string"
+ },
+ "ip": {
+ "type": "string"
+ },
+ "profile": {
+ "type": "string"
+ },
+ "property": {
+ "type": "string"
+ },
+ "received": {
+ "type": "string"
+ },
+ "risk_score": {
+ "type": "number"
+ },
+ "risk_score_rating": {
+ "type": "string"
+ },
+ "risk_score_vector": {
+ "type": "string"
+ },
+ "threat_level": {
+ "type": "integer"
+ },
+ "threat_score": {
+ "type": "number"
+ },
+ "threat_score_rating": {
+ "type": "string"
+ },
+ "threat_score_vector": {
+ "type": "string"
+ },
+ "tld": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ },
+ "url": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "id"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ }
+ }
+ }
+ }
+ }
+ },
+ "name": "[[parameters('PlaybookName')]",
+ "type": "Microsoft.Logic/workflows",
+ "location": "[[variables('workspace-location-inline')]",
+ "tags": {
+ "hidden-SentinelTemplateName": "Infoblox-Import-Hashes-Weekly",
+ "hidden-SentinelTemplateVersion": "1.0",
+ "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]"
+ },
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "apiVersion": "2017-07-01",
+ "dependsOn": "[variables('TemplateEmptyArray')]"
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId3'),'/'))))]",
+ "properties": {
+ "parentId": "[variables('playbookId3')]",
+ "contentId": "[variables('_playbookContentId3')]",
+ "kind": "Playbook",
+ "version": "[variables('playbookVersion3')]",
+ "source": {
+ "kind": "Solution",
+ "name": "Infoblox Cloud Data Connector",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Infoblox",
+ "tier": "Partner",
+ "link": "https://support.infoblox.com/"
+ }
+ }
+ }
+ ],
+ "metadata": {
+ "title": "Infoblox Import Hashes Weekly",
+ "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected hashes on a scheduled weekly basis.",
+ "prerequisites": [
+ "Infoblox TIDE API key."
+ ],
+ "postDeployment": [
+ "Authorize connections."
+ ],
+ "lastUpdateTime": "2023-08-07T00:00:00Z",
+ "releaseNotes": {
+ "version": "1.0",
+ "title": "[variables('blanks')]",
+ "notes": [
+ "Initial version"
+ ]
+ }
+ }
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('_playbookContentId3')]",
+ "contentKind": "Playbook",
+ "displayName": "Infoblox-Import-Hashes-Weekly",
+ "contentProductId": "[variables('_playbookcontentProductId3')]",
+ "id": "[variables('_playbookcontentProductId3')]",
+ "version": "[variables('playbookVersion3')]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('playbookTemplateSpecName4')]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "Infoblox-Import-Hosts-Daily-LookalikeDomains Playbook with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('playbookVersion4')]",
+ "parameters": {
+ "PlaybookName": {
+ "defaultValue": "Infoblox-Import-Hosts-Daily-LookalikeDomains",
+ "type": "string"
+ },
+ "AD Application Secret": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for AD Application Secret"
+ }
+ },
+ "Client ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Client ID"
+ }
+ },
+ "TIDE API Key": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for TIDE API Key"
+ }
+ },
+ "Tenant ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Tenant ID"
+ }
+ }
+ },
+ "variables": {
+ "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]",
+ "workspace-name": "[parameters('workspace')]",
+ "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]"
+ },
+ "resources": [
+ {
+ "properties": {
+ "provisioningState": "Succeeded",
+ "state": "Disabled",
+ "definition": {
+ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "AD Application Secret": {
+ "defaultValue": "[[parameters('AD Application Secret')]",
+ "type": "string"
+ },
+ "Client ID": {
+ "defaultValue": "[[parameters('Client ID')]",
+ "type": "string"
+ },
+ "TIDE API Key": {
+ "defaultValue": "[[parameters('TIDE API Key')]",
+ "type": "string"
+ },
+ "Tenant ID": {
+ "defaultValue": "[[parameters('Tenant ID')]",
+ "type": "string"
+ }
+ },
+ "triggers": {
+ "Recurrence": {
+ "recurrence": {
+ "frequency": "Day",
+ "interval": 1
+ },
+ "evaluatedRecurrence": {
+ "frequency": "Day",
+ "interval": 1
+ },
+ "type": "Recurrence"
+ }
+ },
+ "actions": {
+ "For_Each_Indicator_(Threat)": {
+ "foreach": "@body('Parse_JSON')?['threat']",
+ "actions": {
+ "Switch": {
+ "cases": {
+ "EMAIL": {
+ "case": "EMAIL",
+ "actions": {
+ "Send_Emails_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}",
+ "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HASH": {
+ "case": "HASH",
+ "actions": {
+ "Send_Hashes_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}",
+ "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}",
+ "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HOST": {
+ "case": "HOST",
+ "actions": {
+ "Send_Hosts_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "IP": {
+ "case": "IP",
+ "actions": {
+ "Send_IPs_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "URL": {
+ "case": "URL",
+ "actions": {
+ "Send_URLs_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white",
+ "url": "@{items('For_Each_Indicator_(Threat)')?['url']}"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ }
+ },
+ "expression": "@items('For_Each_Indicator_(Threat)')?['type']",
+ "type": "Switch"
+ }
+ },
+ "runAfter": {
+ "Parse_JSON": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "Get_TIDE_Data": {
+ "type": "Http",
+ "inputs": {
+ "headers": {
+ "Authorization": "Token @{parameters('TIDE API Key')}"
+ },
+ "method": "GET",
+ "queries": {
+ "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url",
+ "property": "Policy_LookalikeDomains",
+ "rlimit": "90000"
+ },
+ "uri": "https://csp.infoblox.com/tide/api/data/threats/host/daily"
+ }
+ },
+ "Parse_JSON": {
+ "runAfter": {
+ "Get_TIDE_Data": [
+ "Succeeded"
+ ]
+ },
+ "type": "ParseJson",
+ "inputs": {
+ "content": "@body('Get_TIDE_Data')",
+ "schema": {
+ "properties": {
+ "record_count": {
+ "type": "integer"
+ },
+ "threat": {
+ "items": {
+ "properties": {
+ "batch_id": {
+ "type": "string"
+ },
+ "class": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "integer"
+ },
+ "confidence_score": {
+ "type": "number"
+ },
+ "confidence_score_rating": {
+ "type": "string"
+ },
+ "confidence_score_vector": {
+ "type": "string"
+ },
+ "detected": {
+ "type": "string"
+ },
+ "domain": {
+ "type": "string"
+ },
+ "email": {
+ "type": "string"
+ },
+ "expiration": {
+ "type": "string"
+ },
+ "extended": {
+ "properties": {
+ "ais_consent": {
+ "type": "string"
+ },
+ "cyberint_guid": {
+ "type": "string"
+ },
+ "no_whitelist": {
+ "type": "string"
+ },
+ "notes": {
+ "type": "string"
+ },
+ "protocol": {
+ "type": "string"
+ },
+ "url_hash": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "hash": {
+ "type": "string"
+ },
+ "hash_type": {
+ "type": "string"
+ },
+ "host": {
+ "type": "string"
+ },
+ "id": {
+ "type": "string"
+ },
+ "imported": {
+ "type": "string"
+ },
+ "ip": {
+ "type": "string"
+ },
+ "profile": {
+ "type": "string"
+ },
+ "property": {
+ "type": "string"
+ },
+ "received": {
+ "type": "string"
+ },
+ "risk_score": {
+ "type": "number"
+ },
+ "risk_score_rating": {
+ "type": "string"
+ },
+ "risk_score_vector": {
+ "type": "string"
+ },
+ "threat_level": {
+ "type": "integer"
+ },
+ "threat_score": {
+ "type": "number"
+ },
+ "threat_score_rating": {
+ "type": "string"
+ },
+ "threat_score_vector": {
+ "type": "string"
+ },
+ "tld": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ },
+ "url": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "id"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ }
+ }
+ }
+ }
+ }
+ },
+ "name": "[[parameters('PlaybookName')]",
+ "type": "Microsoft.Logic/workflows",
+ "location": "[[variables('workspace-location-inline')]",
+ "tags": {
+ "hidden-SentinelTemplateName": "Infoblox-Import-Hosts-Daily-LookalikeDomains",
+ "hidden-SentinelTemplateVersion": "1.0",
+ "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]"
+ },
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "apiVersion": "2017-07-01",
+ "dependsOn": "[variables('TemplateEmptyArray')]"
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId4'),'/'))))]",
+ "properties": {
+ "parentId": "[variables('playbookId4')]",
+ "contentId": "[variables('_playbookContentId4')]",
+ "kind": "Playbook",
+ "version": "[variables('playbookVersion4')]",
+ "source": {
+ "kind": "Solution",
+ "name": "Infoblox Cloud Data Connector",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Infoblox",
+ "tier": "Partner",
+ "link": "https://support.infoblox.com/"
+ }
+ }
+ }
+ ],
+ "metadata": {
+ "title": "Infoblox Import Hosts Daily Lookalike Domains",
+ "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected Lookalike domains on a scheduled daily basis.",
+ "prerequisites": [
+ "Infoblox TIDE API key."
+ ],
+ "postDeployment": [
+ "Authorize connections."
+ ],
+ "lastUpdateTime": "2023-08-07T00:00:00Z",
+ "releaseNotes": {
+ "version": "1.0",
+ "title": "[variables('blanks')]",
+ "notes": [
+ "Initial version"
+ ]
+ }
+ }
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('_playbookContentId4')]",
+ "contentKind": "Playbook",
+ "displayName": "Infoblox-Import-Hosts-Daily-LookalikeDomains",
+ "contentProductId": "[variables('_playbookcontentProductId4')]",
+ "id": "[variables('_playbookcontentProductId4')]",
+ "version": "[variables('playbookVersion4')]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('playbookTemplateSpecName5')]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "Infoblox-Import-Hosts-Daily-MalwareC2DGA Playbook with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('playbookVersion5')]",
+ "parameters": {
+ "PlaybookName": {
+ "defaultValue": "Infoblox-Import-Hosts-Daily-MalwareC2DGA",
+ "type": "string"
+ },
+ "AD Application Secret": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for AD Application Secret"
+ }
+ },
+ "Client ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Client ID"
+ }
+ },
+ "TIDE API Key": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for TIDE API Key"
+ }
+ },
+ "Tenant ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Tenant ID"
+ }
+ }
+ },
+ "variables": {
+ "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]",
+ "workspace-name": "[parameters('workspace')]",
+ "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]"
+ },
+ "resources": [
+ {
+ "properties": {
+ "provisioningState": "Succeeded",
+ "state": "Disabled",
+ "definition": {
+ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "AD Application Secret": {
+ "defaultValue": "[[parameters('AD Application Secret')]",
+ "type": "string"
+ },
+ "Client ID": {
+ "defaultValue": "[[parameters('Client ID')]",
+ "type": "string"
+ },
+ "TIDE API Key": {
+ "defaultValue": "[[parameters('TIDE API Key')]",
+ "type": "string"
+ },
+ "Tenant ID": {
+ "defaultValue": "[[parameters('Tenant ID')]",
+ "type": "string"
+ }
+ },
+ "triggers": {
+ "Recurrence": {
+ "recurrence": {
+ "frequency": "Day",
+ "interval": 1
+ },
+ "evaluatedRecurrence": {
+ "frequency": "Day",
+ "interval": 1
+ },
+ "type": "Recurrence"
+ }
+ },
+ "actions": {
+ "For_Each_Indicator_(Threat)": {
+ "foreach": "@body('Parse_JSON')?['threat']",
+ "actions": {
+ "Switch": {
+ "cases": {
+ "EMAIL": {
+ "case": "EMAIL",
+ "actions": {
+ "Send_Emails_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}",
+ "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HASH": {
+ "case": "HASH",
+ "actions": {
+ "Send_Hashes_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}",
+ "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}",
+ "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HOST": {
+ "case": "HOST",
+ "actions": {
+ "Send_Hosts_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "IP": {
+ "case": "IP",
+ "actions": {
+ "Send_IPs_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "URL": {
+ "case": "URL",
+ "actions": {
+ "Send_URLs_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white",
+ "url": "@{items('For_Each_Indicator_(Threat)')?['url']}"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ }
+ },
+ "expression": "@items('For_Each_Indicator_(Threat)')?['type']",
+ "type": "Switch"
+ }
+ },
+ "runAfter": {
+ "Parse_JSON": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "Get_TIDE_Data": {
+ "type": "Http",
+ "inputs": {
+ "headers": {
+ "Authorization": "Token @{parameters('TIDE API Key')}"
+ },
+ "method": "GET",
+ "queries": {
+ "class": "MalwareC2DGA",
+ "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url",
+ "rlimit": "90000"
+ },
+ "uri": "https://csp.infoblox.com/tide/api/data/threats/host/daily"
+ }
+ },
+ "Parse_JSON": {
+ "runAfter": {
+ "Get_TIDE_Data": [
+ "Succeeded"
+ ]
+ },
+ "type": "ParseJson",
+ "inputs": {
+ "content": "@body('Get_TIDE_Data')",
+ "schema": {
+ "properties": {
+ "record_count": {
+ "type": "integer"
+ },
+ "threat": {
+ "items": {
+ "properties": {
+ "batch_id": {
+ "type": "string"
+ },
+ "class": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "integer"
+ },
+ "confidence_score": {
+ "type": "number"
+ },
+ "confidence_score_rating": {
+ "type": "string"
+ },
+ "confidence_score_vector": {
+ "type": "string"
+ },
+ "detected": {
+ "type": "string"
+ },
+ "domain": {
+ "type": "string"
+ },
+ "email": {
+ "type": "string"
+ },
+ "expiration": {
+ "type": "string"
+ },
+ "extended": {
+ "properties": {
+ "ais_consent": {
+ "type": "string"
+ },
+ "cyberint_guid": {
+ "type": "string"
+ },
+ "no_whitelist": {
+ "type": "string"
+ },
+ "notes": {
+ "type": "string"
+ },
+ "protocol": {
+ "type": "string"
+ },
+ "url_hash": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "hash": {
+ "type": "string"
+ },
+ "hash_type": {
+ "type": "string"
+ },
+ "host": {
+ "type": "string"
+ },
+ "id": {
+ "type": "string"
+ },
+ "imported": {
+ "type": "string"
+ },
+ "ip": {
+ "type": "string"
+ },
+ "profile": {
+ "type": "string"
+ },
+ "property": {
+ "type": "string"
+ },
+ "received": {
+ "type": "string"
+ },
+ "risk_score": {
+ "type": "number"
+ },
+ "risk_score_rating": {
+ "type": "string"
+ },
+ "risk_score_vector": {
+ "type": "string"
+ },
+ "threat_level": {
+ "type": "integer"
+ },
+ "threat_score": {
+ "type": "number"
+ },
+ "threat_score_rating": {
+ "type": "string"
+ },
+ "threat_score_vector": {
+ "type": "string"
+ },
+ "tld": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ },
+ "url": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "id"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ }
+ }
+ }
+ }
+ }
+ },
+ "name": "[[parameters('PlaybookName')]",
+ "type": "Microsoft.Logic/workflows",
+ "location": "[[variables('workspace-location-inline')]",
+ "tags": {
+ "hidden-SentinelTemplateName": "Infoblox-Import-Hosts-Daily-MalwareC2DGA",
+ "hidden-SentinelTemplateVersion": "1.0",
+ "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]"
+ },
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "apiVersion": "2017-07-01",
+ "dependsOn": "[variables('TemplateEmptyArray')]"
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId5'),'/'))))]",
+ "properties": {
+ "parentId": "[variables('playbookId5')]",
+ "contentId": "[variables('_playbookContentId5')]",
+ "kind": "Playbook",
+ "version": "[variables('playbookVersion5')]",
+ "source": {
+ "kind": "Solution",
+ "name": "Infoblox Cloud Data Connector",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Infoblox",
+ "tier": "Partner",
+ "link": "https://support.infoblox.com/"
+ }
+ }
+ }
+ ],
+ "metadata": {
+ "title": "Infoblox Import Hosts Daily MalwareC2DGA",
+ "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected MalwareC2DGA domains on a scheduled daily basis.",
+ "prerequisites": [
+ "Infoblox TIDE API key."
+ ],
+ "postDeployment": [
+ "Authorize connections."
+ ],
+ "lastUpdateTime": "2023-08-07T00:00:00Z",
+ "releaseNotes": {
+ "version": "1.0",
+ "title": "[variables('blanks')]",
+ "notes": [
+ "Initial version"
+ ]
+ }
+ }
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('_playbookContentId5')]",
+ "contentKind": "Playbook",
+ "displayName": "Infoblox-Import-Hosts-Daily-MalwareC2DGA",
+ "contentProductId": "[variables('_playbookcontentProductId5')]",
+ "id": "[variables('_playbookcontentProductId5')]",
+ "version": "[variables('playbookVersion5')]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('playbookTemplateSpecName6')]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "Infoblox-Import-Hosts-Daily-Phishing Playbook with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('playbookVersion6')]",
+ "parameters": {
+ "PlaybookName": {
+ "defaultValue": "Infoblox-Import-Hosts-Daily-Phishing",
+ "type": "string"
+ },
+ "AD Application Secret": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for AD Application Secret"
+ }
+ },
+ "Client ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Client ID"
+ }
+ },
+ "TIDE API Key": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for TIDE API Key"
+ }
+ },
+ "Tenant ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Tenant ID"
+ }
+ }
+ },
+ "variables": {
+ "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]",
+ "workspace-name": "[parameters('workspace')]",
+ "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]"
+ },
+ "resources": [
+ {
+ "properties": {
+ "provisioningState": "Succeeded",
+ "state": "Disabled",
+ "definition": {
+ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "AD Application Secret": {
+ "defaultValue": "[[parameters('AD Application Secret')]",
+ "type": "string"
+ },
+ "Client ID": {
+ "defaultValue": "[[parameters('Client ID')]",
+ "type": "string"
+ },
+ "TIDE API Key": {
+ "defaultValue": "[[parameters('TIDE API Key')]",
+ "type": "string"
+ },
+ "Tenant ID": {
+ "defaultValue": "[[parameters('Tenant ID')]",
+ "type": "string"
+ }
+ },
+ "triggers": {
+ "Recurrence": {
+ "recurrence": {
+ "frequency": "Day",
+ "interval": 1
+ },
+ "evaluatedRecurrence": {
+ "frequency": "Day",
+ "interval": 1
+ },
+ "type": "Recurrence"
+ }
+ },
+ "actions": {
+ "For_Each_Indicator_(Threat)": {
+ "foreach": "@body('Parse_JSON')?['threat']",
+ "actions": {
+ "Switch": {
+ "cases": {
+ "EMAIL": {
+ "case": "EMAIL",
+ "actions": {
+ "Send_Emails_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}",
+ "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HASH": {
+ "case": "HASH",
+ "actions": {
+ "Send_Hashes_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}",
+ "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}",
+ "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HOST": {
+ "case": "HOST",
+ "actions": {
+ "Send_Hosts_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "IP": {
+ "case": "IP",
+ "actions": {
+ "Send_IPs_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "URL": {
+ "case": "URL",
+ "actions": {
+ "Send_URLs_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white",
+ "url": "@{items('For_Each_Indicator_(Threat)')?['url']}"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ }
+ },
+ "expression": "@items('For_Each_Indicator_(Threat)')?['type']",
+ "type": "Switch"
+ }
+ },
+ "runAfter": {
+ "Parse_JSON": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "Get_TIDE_Data": {
+ "type": "Http",
+ "inputs": {
+ "headers": {
+ "Authorization": "Token @{parameters('TIDE API Key')}"
+ },
+ "method": "GET",
+ "queries": {
+ "class": "Phishing",
+ "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url",
+ "rlimit": "90000"
+ },
+ "uri": "https://csp.infoblox.com/tide/api/data/threats/host/daily"
+ }
+ },
+ "Parse_JSON": {
+ "runAfter": {
+ "Get_TIDE_Data": [
+ "Succeeded"
+ ]
+ },
+ "type": "ParseJson",
+ "inputs": {
+ "content": "@body('Get_TIDE_Data')",
+ "schema": {
+ "properties": {
+ "record_count": {
+ "type": "integer"
+ },
+ "threat": {
+ "items": {
+ "properties": {
+ "batch_id": {
+ "type": "string"
+ },
+ "class": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "integer"
+ },
+ "confidence_score": {
+ "type": "number"
+ },
+ "confidence_score_rating": {
+ "type": "string"
+ },
+ "confidence_score_vector": {
+ "type": "string"
+ },
+ "detected": {
+ "type": "string"
+ },
+ "domain": {
+ "type": "string"
+ },
+ "email": {
+ "type": "string"
+ },
+ "expiration": {
+ "type": "string"
+ },
+ "extended": {
+ "properties": {
+ "ais_consent": {
+ "type": "string"
+ },
+ "cyberint_guid": {
+ "type": "string"
+ },
+ "no_whitelist": {
+ "type": "string"
+ },
+ "notes": {
+ "type": "string"
+ },
+ "protocol": {
+ "type": "string"
+ },
+ "url_hash": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "hash": {
+ "type": "string"
+ },
+ "hash_type": {
+ "type": "string"
+ },
+ "host": {
+ "type": "string"
+ },
+ "id": {
+ "type": "string"
+ },
+ "imported": {
+ "type": "string"
+ },
+ "ip": {
+ "type": "string"
+ },
+ "profile": {
+ "type": "string"
+ },
+ "property": {
+ "type": "string"
+ },
+ "received": {
+ "type": "string"
+ },
+ "risk_score": {
+ "type": "number"
+ },
+ "risk_score_rating": {
+ "type": "string"
+ },
+ "risk_score_vector": {
+ "type": "string"
+ },
+ "threat_level": {
+ "type": "integer"
+ },
+ "threat_score": {
+ "type": "number"
+ },
+ "threat_score_rating": {
+ "type": "string"
+ },
+ "threat_score_vector": {
+ "type": "string"
+ },
+ "tld": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ },
+ "url": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "id"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ }
+ }
+ }
+ }
+ }
+ },
+ "name": "[[parameters('PlaybookName')]",
+ "type": "Microsoft.Logic/workflows",
+ "location": "[[variables('workspace-location-inline')]",
+ "tags": {
+ "hidden-SentinelTemplateName": "Infoblox-Import-Hosts-Daily-Phishing",
+ "hidden-SentinelTemplateVersion": "1.0",
+ "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]"
+ },
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "apiVersion": "2017-07-01",
+ "dependsOn": "[variables('TemplateEmptyArray')]"
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId6'),'/'))))]",
+ "properties": {
+ "parentId": "[variables('playbookId6')]",
+ "contentId": "[variables('_playbookContentId6')]",
+ "kind": "Playbook",
+ "version": "[variables('playbookVersion6')]",
+ "source": {
+ "kind": "Solution",
+ "name": "Infoblox Cloud Data Connector",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Infoblox",
+ "tier": "Partner",
+ "link": "https://support.infoblox.com/"
+ }
+ }
+ }
+ ],
+ "metadata": {
+ "title": "Infoblox Import Hosts Daily Phishing",
+ "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected Phishing domains on a scheduled daily basis.",
+ "prerequisites": [
+ "Infoblox TIDE API key."
+ ],
+ "postDeployment": [
+ "Authorize connections."
+ ],
+ "lastUpdateTime": "2023-08-07T00:00:00Z",
+ "releaseNotes": {
+ "version": "1.0",
+ "title": "[variables('blanks')]",
+ "notes": [
+ "Initial version"
+ ]
+ }
+ }
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('_playbookContentId6')]",
+ "contentKind": "Playbook",
+ "displayName": "Infoblox-Import-Hosts-Daily-Phishing",
+ "contentProductId": "[variables('_playbookcontentProductId6')]",
+ "id": "[variables('_playbookcontentProductId6')]",
+ "version": "[variables('playbookVersion6')]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('playbookTemplateSpecName7')]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "Infoblox-Import-Hosts-Hourly Playbook with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('playbookVersion7')]",
+ "parameters": {
+ "PlaybookName": {
+ "defaultValue": "Infoblox-Import-Hosts-Hourly",
+ "type": "string"
+ },
+ "AD Application Secret": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for AD Application Secret"
+ }
+ },
+ "Client ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Client ID"
+ }
+ },
+ "TIDE API Key": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for TIDE API Key"
+ }
+ },
+ "Tenant ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Tenant ID"
+ }
+ }
+ },
+ "variables": {
+ "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]",
+ "workspace-name": "[parameters('workspace')]",
+ "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]"
+ },
+ "resources": [
+ {
+ "properties": {
+ "provisioningState": "Succeeded",
+ "state": "Disabled",
+ "definition": {
+ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "AD Application Secret": {
+ "defaultValue": "[[parameters('AD Application Secret')]",
+ "type": "string"
+ },
+ "Client ID": {
+ "defaultValue": "[[parameters('Client ID')]",
+ "type": "string"
+ },
+ "TIDE API Key": {
+ "defaultValue": "[[parameters('TIDE API Key')]",
+ "type": "string"
+ },
+ "Tenant ID": {
+ "defaultValue": "[[parameters('Tenant ID')]",
+ "type": "string"
+ }
+ },
+ "triggers": {
+ "Recurrence": {
+ "recurrence": {
+ "frequency": "Hour",
+ "interval": 1
+ },
+ "evaluatedRecurrence": {
+ "frequency": "Hour",
+ "interval": 1
+ },
+ "type": "Recurrence"
+ }
+ },
+ "actions": {
+ "For_Each_Indicator_(Threat)": {
+ "foreach": "@body('Parse_JSON')?['threat']",
+ "actions": {
+ "Switch": {
+ "cases": {
+ "EMAIL": {
+ "case": "EMAIL",
+ "actions": {
+ "Send_Emails_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}",
+ "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HASH": {
+ "case": "HASH",
+ "actions": {
+ "Send_Hashes_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}",
+ "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}",
+ "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HOST": {
+ "case": "HOST",
+ "actions": {
+ "Send_Hosts_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "IP": {
+ "case": "IP",
+ "actions": {
+ "Send_IPs_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "URL": {
+ "case": "URL",
+ "actions": {
+ "Send_URLs_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white",
+ "url": "@{items('For_Each_Indicator_(Threat)')?['url']}"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ }
+ },
+ "expression": "@items('For_Each_Indicator_(Threat)')?['type']",
+ "type": "Switch"
+ }
+ },
+ "runAfter": {
+ "Parse_JSON": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "Get_TIDE_Data": {
+ "type": "Http",
+ "inputs": {
+ "headers": {
+ "Authorization": "Token @{parameters('TIDE API Key')}"
+ },
+ "method": "GET",
+ "queries": {
+ "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url",
+ "rlimit": "90000"
+ },
+ "uri": "https://csp.infoblox.com/tide/api/data/threats/host/hourly"
+ }
+ },
+ "Parse_JSON": {
+ "runAfter": {
+ "Get_TIDE_Data": [
+ "Succeeded"
+ ]
+ },
+ "type": "ParseJson",
+ "inputs": {
+ "content": "@body('Get_TIDE_Data')",
+ "schema": {
+ "properties": {
+ "record_count": {
+ "type": "integer"
+ },
+ "threat": {
+ "items": {
+ "properties": {
+ "batch_id": {
+ "type": "string"
+ },
+ "class": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "integer"
+ },
+ "confidence_score": {
+ "type": "number"
+ },
+ "confidence_score_rating": {
+ "type": "string"
+ },
+ "confidence_score_vector": {
+ "type": "string"
+ },
+ "detected": {
+ "type": "string"
+ },
+ "domain": {
+ "type": "string"
+ },
+ "email": {
+ "type": "string"
+ },
+ "expiration": {
+ "type": "string"
+ },
+ "extended": {
+ "properties": {
+ "ais_consent": {
+ "type": "string"
+ },
+ "cyberint_guid": {
+ "type": "string"
+ },
+ "no_whitelist": {
+ "type": "string"
+ },
+ "notes": {
+ "type": "string"
+ },
+ "protocol": {
+ "type": "string"
+ },
+ "url_hash": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "hash": {
+ "type": "string"
+ },
+ "hash_type": {
+ "type": "string"
+ },
+ "host": {
+ "type": "string"
+ },
+ "id": {
+ "type": "string"
+ },
+ "imported": {
+ "type": "string"
+ },
+ "ip": {
+ "type": "string"
+ },
+ "profile": {
+ "type": "string"
+ },
+ "property": {
+ "type": "string"
+ },
+ "received": {
+ "type": "string"
+ },
+ "risk_score": {
+ "type": "number"
+ },
+ "risk_score_rating": {
+ "type": "string"
+ },
+ "risk_score_vector": {
+ "type": "string"
+ },
+ "threat_level": {
+ "type": "integer"
+ },
+ "threat_score": {
+ "type": "number"
+ },
+ "threat_score_rating": {
+ "type": "string"
+ },
+ "threat_score_vector": {
+ "type": "string"
+ },
+ "tld": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ },
+ "url": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "id"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ }
+ }
+ }
+ }
+ }
+ },
+ "name": "[[parameters('PlaybookName')]",
+ "type": "Microsoft.Logic/workflows",
+ "location": "[[variables('workspace-location-inline')]",
+ "tags": {
+ "hidden-SentinelTemplateName": "Infoblox-Import-Hosts-Hourly",
+ "hidden-SentinelTemplateVersion": "1.0",
+ "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]"
+ },
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "apiVersion": "2017-07-01",
+ "dependsOn": "[variables('TemplateEmptyArray')]"
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId7'),'/'))))]",
+ "properties": {
+ "parentId": "[variables('playbookId7')]",
+ "contentId": "[variables('_playbookContentId7')]",
+ "kind": "Playbook",
+ "version": "[variables('playbookVersion7')]",
+ "source": {
+ "kind": "Solution",
+ "name": "Infoblox Cloud Data Connector",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Infoblox",
+ "tier": "Partner",
+ "link": "https://support.infoblox.com/"
+ }
+ }
+ }
+ ],
+ "metadata": {
+ "title": "Infoblox Import Hosts Hourly",
+ "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports all newly detected hosts on a scheduled hourly basis.",
+ "prerequisites": [
+ "Infoblox TIDE API key."
+ ],
+ "postDeployment": [
+ "Authorize connections."
+ ],
+ "lastUpdateTime": "2023-08-07T00:00:00Z",
+ "releaseNotes": {
+ "version": "1.0",
+ "title": "[variables('blanks')]",
+ "notes": [
+ "Initial version"
+ ]
+ }
+ }
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('_playbookContentId7')]",
+ "contentKind": "Playbook",
+ "displayName": "Infoblox-Import-Hosts-Hourly",
+ "contentProductId": "[variables('_playbookcontentProductId7')]",
+ "id": "[variables('_playbookcontentProductId7')]",
+ "version": "[variables('playbookVersion7')]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('playbookTemplateSpecName8')]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "Infoblox-Import-IPs-Hourly Playbook with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('playbookVersion8')]",
+ "parameters": {
+ "PlaybookName": {
+ "defaultValue": "Infoblox-Import-IPs-Hourly",
+ "type": "string"
+ },
+ "AD Application Secret": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for AD Application Secret"
+ }
+ },
+ "Client ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Client ID"
+ }
+ },
+ "TIDE API Key": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for TIDE API Key"
+ }
+ },
+ "Tenant ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Tenant ID"
+ }
+ }
+ },
+ "variables": {
+ "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]",
+ "workspace-name": "[parameters('workspace')]",
+ "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]"
+ },
+ "resources": [
+ {
+ "properties": {
+ "provisioningState": "Succeeded",
+ "state": "Disabled",
+ "definition": {
+ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "AD Application Secret": {
+ "defaultValue": "[[parameters('AD Application Secret')]",
+ "type": "string"
+ },
+ "Client ID": {
+ "defaultValue": "[[parameters('Client ID')]",
+ "type": "string"
+ },
+ "TIDE API Key": {
+ "defaultValue": "[[parameters('TIDE API Key')]",
+ "type": "string"
+ },
+ "Tenant ID": {
+ "defaultValue": "[[parameters('Tenant ID')]",
+ "type": "string"
+ }
+ },
+ "triggers": {
+ "Recurrence": {
+ "recurrence": {
+ "frequency": "Hour",
+ "interval": 1
+ },
+ "evaluatedRecurrence": {
+ "frequency": "Hour",
+ "interval": 1
+ },
+ "type": "Recurrence"
+ }
+ },
+ "actions": {
+ "For_Each_Indicator_(Threat)": {
+ "foreach": "@body('Parse_JSON')?['threat']",
+ "actions": {
+ "Switch": {
+ "cases": {
+ "EMAIL": {
+ "case": "EMAIL",
+ "actions": {
+ "Send_Emails_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}",
+ "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HASH": {
+ "case": "HASH",
+ "actions": {
+ "Send_Hashes_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}",
+ "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}",
+ "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HOST": {
+ "case": "HOST",
+ "actions": {
+ "Send_Hosts_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "IP": {
+ "case": "IP",
+ "actions": {
+ "Send_IPs_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "URL": {
+ "case": "URL",
+ "actions": {
+ "Send_URLs_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white",
+ "url": "@{items('For_Each_Indicator_(Threat)')?['url']}"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ }
+ },
+ "expression": "@items('For_Each_Indicator_(Threat)')?['type']",
+ "type": "Switch"
+ }
+ },
+ "runAfter": {
+ "Parse_JSON": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "Get_TIDE_Data": {
+ "type": "Http",
+ "inputs": {
+ "headers": {
+ "Authorization": "Token @{parameters('TIDE API Key')}"
+ },
+ "method": "GET",
+ "queries": {
+ "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url",
+ "rlimit": "90000"
+ },
+ "uri": "https://csp.infoblox.com/tide/api/data/threats/ip/hourly"
+ }
+ },
+ "Parse_JSON": {
+ "runAfter": {
+ "Get_TIDE_Data": [
+ "Succeeded"
+ ]
+ },
+ "type": "ParseJson",
+ "inputs": {
+ "content": "@body('Get_TIDE_Data')",
+ "schema": {
+ "properties": {
+ "record_count": {
+ "type": "integer"
+ },
+ "threat": {
+ "items": {
+ "properties": {
+ "batch_id": {
+ "type": "string"
+ },
+ "class": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "integer"
+ },
+ "confidence_score": {
+ "type": "number"
+ },
+ "confidence_score_rating": {
+ "type": "string"
+ },
+ "confidence_score_vector": {
+ "type": "string"
+ },
+ "detected": {
+ "type": "string"
+ },
+ "domain": {
+ "type": "string"
+ },
+ "email": {
+ "type": "string"
+ },
+ "expiration": {
+ "type": "string"
+ },
+ "extended": {
+ "properties": {
+ "ais_consent": {
+ "type": "string"
+ },
+ "cyberint_guid": {
+ "type": "string"
+ },
+ "no_whitelist": {
+ "type": "string"
+ },
+ "notes": {
+ "type": "string"
+ },
+ "protocol": {
+ "type": "string"
+ },
+ "url_hash": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "hash": {
+ "type": "string"
+ },
+ "hash_type": {
+ "type": "string"
+ },
+ "host": {
+ "type": "string"
+ },
+ "id": {
+ "type": "string"
+ },
+ "imported": {
+ "type": "string"
+ },
+ "ip": {
+ "type": "string"
+ },
+ "profile": {
+ "type": "string"
+ },
+ "property": {
+ "type": "string"
+ },
+ "received": {
+ "type": "string"
+ },
+ "risk_score": {
+ "type": "number"
+ },
+ "risk_score_rating": {
+ "type": "string"
+ },
+ "risk_score_vector": {
+ "type": "string"
+ },
+ "threat_level": {
+ "type": "integer"
+ },
+ "threat_score": {
+ "type": "number"
+ },
+ "threat_score_rating": {
+ "type": "string"
+ },
+ "threat_score_vector": {
+ "type": "string"
+ },
+ "tld": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ },
+ "url": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "id"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ }
+ }
+ }
+ }
+ }
+ },
+ "name": "[[parameters('PlaybookName')]",
+ "type": "Microsoft.Logic/workflows",
+ "location": "[[variables('workspace-location-inline')]",
+ "tags": {
+ "hidden-SentinelTemplateName": "Infoblox-Import-IPs-Hourly",
+ "hidden-SentinelTemplateVersion": "1.0",
+ "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]"
+ },
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "apiVersion": "2017-07-01",
+ "dependsOn": "[variables('TemplateEmptyArray')]"
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId8'),'/'))))]",
+ "properties": {
+ "parentId": "[variables('playbookId8')]",
+ "contentId": "[variables('_playbookContentId8')]",
+ "kind": "Playbook",
+ "version": "[variables('playbookVersion8')]",
+ "source": {
+ "kind": "Solution",
+ "name": "Infoblox Cloud Data Connector",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Infoblox",
+ "tier": "Partner",
+ "link": "https://support.infoblox.com/"
+ }
+ }
+ }
+ ],
+ "metadata": {
+ "title": "Infoblox Import IPs Hourly",
+ "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports all newly detected IPs on a scheduled hourly basis.",
+ "prerequisites": [
+ "Infoblox TIDE API key."
+ ],
+ "postDeployment": [
+ "Authorize connections."
+ ],
+ "lastUpdateTime": "2023-08-07T00:00:00Z",
+ "releaseNotes": {
+ "version": "1.0",
+ "title": "[variables('blanks')]",
+ "notes": [
+ "Initial version"
+ ]
+ }
+ }
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('_playbookContentId8')]",
+ "contentKind": "Playbook",
+ "displayName": "Infoblox-Import-IPs-Hourly",
+ "contentProductId": "[variables('_playbookcontentProductId8')]",
+ "id": "[variables('_playbookcontentProductId8')]",
+ "version": "[variables('playbookVersion8')]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('playbookTemplateSpecName9')]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "Infoblox-Import-URLs-Hourly Playbook with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('playbookVersion9')]",
+ "parameters": {
+ "PlaybookName": {
+ "defaultValue": "Infoblox-Import-URLs-Hourly",
+ "type": "string"
+ },
+ "AD Application Secret": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for AD Application Secret"
+ }
+ },
+ "Client ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Client ID"
+ }
+ },
+ "TIDE API Key": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for TIDE API Key"
+ }
+ },
+ "Tenant ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Tenant ID"
+ }
+ }
+ },
+ "variables": {
+ "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]",
+ "workspace-name": "[parameters('workspace')]",
+ "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]"
+ },
+ "resources": [
+ {
+ "properties": {
+ "provisioningState": "Succeeded",
+ "state": "Disabled",
+ "definition": {
+ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "AD Application Secret": {
+ "defaultValue": "[[parameters('AD Application Secret')]",
+ "type": "string"
+ },
+ "Client ID": {
+ "defaultValue": "[[parameters('Client ID')]",
+ "type": "string"
+ },
+ "TIDE API Key": {
+ "defaultValue": "[[parameters('TIDE API Key')]",
+ "type": "string"
+ },
+ "Tenant ID": {
+ "defaultValue": "[[parameters('Tenant ID')]",
+ "type": "string"
+ }
+ },
+ "triggers": {
+ "Recurrence": {
+ "recurrence": {
+ "frequency": "Hour",
+ "interval": 1
+ },
+ "evaluatedRecurrence": {
+ "frequency": "Hour",
+ "interval": 1
+ },
+ "type": "Recurrence"
+ }
+ },
+ "actions": {
+ "For_Each_Indicator_(Threat)": {
+ "foreach": "@body('Parse_JSON')?['threat']",
+ "actions": {
+ "Switch": {
+ "cases": {
+ "EMAIL": {
+ "case": "EMAIL",
+ "actions": {
+ "Send_Emails_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}",
+ "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HASH": {
+ "case": "HASH",
+ "actions": {
+ "Send_Hashes_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}",
+ "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}",
+ "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HOST": {
+ "case": "HOST",
+ "actions": {
+ "Send_Hosts_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "IP": {
+ "case": "IP",
+ "actions": {
+ "Send_IPs_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "URL": {
+ "case": "URL",
+ "actions": {
+ "Send_URLs_to_Sentinel": {
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white",
+ "url": "@{items('For_Each_Indicator_(Threat)')?['url']}"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ }
+ },
+ "expression": "@items('For_Each_Indicator_(Threat)')?['type']",
+ "type": "Switch"
+ }
+ },
+ "runAfter": {
+ "Parse_JSON": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "Get_TIDE_Data": {
+ "type": "Http",
+ "inputs": {
+ "headers": {
+ "Authorization": "Token @{parameters('TIDE API Key')}"
+ },
+ "method": "GET",
+ "queries": {
+ "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url",
+ "rlimit": "90000"
+ },
+ "uri": "https://csp.infoblox.com/tide/api/data/threats/url/hourly"
+ }
+ },
+ "Parse_JSON": {
+ "runAfter": {
+ "Get_TIDE_Data": [
+ "Succeeded"
+ ]
+ },
+ "type": "ParseJson",
+ "inputs": {
+ "content": "@body('Get_TIDE_Data')",
+ "schema": {
+ "properties": {
+ "record_count": {
+ "type": "integer"
+ },
+ "threat": {
+ "items": {
+ "properties": {
+ "batch_id": {
+ "type": "string"
+ },
+ "class": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "integer"
+ },
+ "confidence_score": {
+ "type": "number"
+ },
+ "confidence_score_rating": {
+ "type": "string"
+ },
+ "confidence_score_vector": {
+ "type": "string"
+ },
+ "detected": {
+ "type": "string"
+ },
+ "domain": {
+ "type": "string"
+ },
+ "email": {
+ "type": "string"
+ },
+ "expiration": {
+ "type": "string"
+ },
+ "extended": {
+ "properties": {
+ "ais_consent": {
+ "type": "string"
+ },
+ "cyberint_guid": {
+ "type": "string"
+ },
+ "no_whitelist": {
+ "type": "string"
+ },
+ "notes": {
+ "type": "string"
+ },
+ "protocol": {
+ "type": "string"
+ },
+ "url_hash": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "hash": {
+ "type": "string"
+ },
+ "hash_type": {
+ "type": "string"
+ },
+ "host": {
+ "type": "string"
+ },
+ "id": {
+ "type": "string"
+ },
+ "imported": {
+ "type": "string"
+ },
+ "ip": {
+ "type": "string"
+ },
+ "profile": {
+ "type": "string"
+ },
+ "property": {
+ "type": "string"
+ },
+ "received": {
+ "type": "string"
+ },
+ "risk_score": {
+ "type": "number"
+ },
+ "risk_score_rating": {
+ "type": "string"
+ },
+ "risk_score_vector": {
+ "type": "string"
+ },
+ "threat_level": {
+ "type": "integer"
+ },
+ "threat_score": {
+ "type": "number"
+ },
+ "threat_score_rating": {
+ "type": "string"
+ },
+ "threat_score_vector": {
+ "type": "string"
+ },
+ "tld": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ },
+ "url": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "id"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ }
+ }
+ }
+ }
+ }
+ },
+ "name": "[[parameters('PlaybookName')]",
+ "type": "Microsoft.Logic/workflows",
+ "location": "[[variables('workspace-location-inline')]",
+ "tags": {
+ "hidden-SentinelTemplateName": "Infoblox-Import-URLs-Hourly",
+ "hidden-SentinelTemplateVersion": "1.0",
+ "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]"
+ },
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "apiVersion": "2017-07-01",
+ "dependsOn": "[variables('TemplateEmptyArray')]"
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId9'),'/'))))]",
+ "properties": {
+ "parentId": "[variables('playbookId9')]",
+ "contentId": "[variables('_playbookContentId9')]",
+ "kind": "Playbook",
+ "version": "[variables('playbookVersion9')]",
+ "source": {
+ "kind": "Solution",
+ "name": "Infoblox Cloud Data Connector",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Infoblox",
+ "tier": "Partner",
+ "link": "https://support.infoblox.com/"
+ }
+ }
+ }
+ ],
+ "metadata": {
+ "title": "Infoblox Import URLs Hourly",
+ "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports all newly detected URLs on a scheduled hourly basis.",
+ "prerequisites": [
+ "Infoblox TIDE API key."
+ ],
+ "postDeployment": [
+ "Authorize connections."
+ ],
+ "lastUpdateTime": "2023-08-07T00:00:00Z",
+ "releaseNotes": {
+ "version": "1.0",
+ "title": "[variables('blanks')]",
+ "notes": [
+ "Initial version"
+ ]
+ }
+ }
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('_playbookContentId9')]",
+ "contentKind": "Playbook",
+ "displayName": "Infoblox-Import-URLs-Hourly",
+ "contentProductId": "[variables('_playbookcontentProductId9')]",
+ "id": "[variables('_playbookcontentProductId9')]",
+ "version": "[variables('playbookVersion9')]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('playbookTemplateSpecName10')]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "Infoblox-Incident-Enrichment-Domains Playbook with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('playbookVersion10')]",
+ "parameters": {
+ "PlaybookName": {
+ "defaultValue": "Infoblox-Incident-Enrichment-Domains",
+ "type": "string"
+ },
+ "TIDE API Key": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for TIDE API Key"
+ }
+ }
+ },
+ "variables": {
+ "MicrosoftSentinelConnectionName": "[[concat('MicrosoftSentinel-', parameters('PlaybookName'))]",
+ "connection-2": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/Azuresentinel')]",
+ "_connection-2": "[[variables('connection-2')]",
+ "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]",
+ "workspace-name": "[parameters('workspace')]",
+ "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]"
+ },
+ "resources": [
+ {
+ "properties": {
+ "provisioningState": "Succeeded",
+ "state": "Disabled",
+ "definition": {
+ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "$connections": {
+ "type": "Object"
+ },
+ "TIDE API Key": {
+ "defaultValue": "[[parameters('TIDE API Key')]",
+ "type": "string"
+ }
+ },
+ "triggers": {
+ "Microsoft_Sentinel_incident": {
+ "type": "ApiConnectionWebhook",
+ "inputs": {
+ "body": {
+ "callback_url": "@{listCallbackUrl()}"
+ },
+ "host": {
+ "connection": {
+ "name": "@parameters('$connections')['azuresentinel']['connectionId']"
+ }
+ },
+ "path": "/incident-creation"
+ }
+ }
+ },
+ "actions": {
+ "Entities_-_Get_DNS": {
+ "runAfter": {
+ "Initialize_HTML": [
+ "Succeeded"
+ ]
+ },
+ "type": "ApiConnection",
+ "inputs": {
+ "body": "@triggerBody()?['object']?['properties']?['relatedEntities']",
+ "host": {
+ "connection": {
+ "name": "@parameters('$connections')['azuresentinel']['connectionId']"
+ }
+ },
+ "method": "post",
+ "path": "/entities/dnsresolution"
+ }
+ },
+ "For_each_DNS_Domain_Entity": {
+ "foreach": "@body('Entities_-_Get_DNS')?['Dnsresolutions']",
+ "actions": {
+ "For_each_Threat_IoC": {
+ "foreach": "@body('Parse_JSON')?['threat']",
+ "actions": {
+ "Enrich_Incident_with_TIDE_Data_if_it_exists": {
+ "else": {
+ "actions": {
+ "Add_comment_to_incident": {
+ "runAfter": {
+ "Set_HTML_Table_with_TIDE_Data": [
+ "Succeeded"
+ ]
+ },
+ "type": "ApiConnection",
+ "inputs": {
+ "body": {
+ "incidentArmId": "@triggerBody()?['object']?['id']",
+ "message": "IoC - @{items('For_each_DNS_Domain_Entity')?['DomainName']} - @{items('For_each_Threat_IoC')?['type']} - @{items('For_each_Threat_IoC')?['class']}
\n@{variables('html')}
"
+ },
+ "host": {
+ "connection": {
+ "name": "@parameters('$connections')['azuresentinel']['connectionId']"
+ }
+ },
+ "method": "post",
+ "path": "/Incidents/Comment"
+ }
+ },
+ "Set_HTML_Table_with_TIDE_Data": {
+ "type": "SetVariable",
+ "inputs": {
+ "name": "html",
+ "value": " \n| ID | @{items('For_each_Threat_IoC')?['id']} |
\n| Type | @{items('For_each_Threat_IoC')?['type']} |
\n| Host | @{items('For_each_Threat_IoC')?['host']} |
\n| Domain | @{items('For_each_Threat_IoC')?['domain']} |
\n| URL | @{items('For_each_Threat_IoC')?['url']} |
\n| IP | @{items('For_each_Threat_IoC')?['ip']} |
\nEmail | @{items('For_each_Threat_IoC')?['email']} | \n| Hash | @{items('For_each_Threat_IoC')?['hash']} @{items('For_each_Threat_IoC')?['hash_type']} |
\n| Profile | @{items('For_each_Threat_IoC')?['profile']} |
\n| Property | @{items('For_each_Threat_IoC')?['property']} |
\n| Threat Level | @{items('For_each_Threat_IoC')?['threat_level']} |
\n| Confidence | @{items('For_each_Threat_IoC')?['confidence']} | \n
\n| Detected | @{items('For_each_Threat_IoC')?['detected']} |
\n| Received | @{items('For_each_Threat_IoC')?['received']} |
\n| Imported | @{items('For_each_Threat_IoC')?['imported']} |
\n| Expiration | @{items('For_each_Threat_IoC')?['expiration']} |
\n| Description | @{items('For_each_Threat_IoC')?['extended']?['notes']} |
\n| Open in CSP | https://csp.infoblox.com/#/security_research/search/auto/@{items('For_each_Threat_IoC')?['host']}/summary |
\n
"
+ }
+ },
+ "Update_incident_Tags": {
+ "runAfter": {
+ "Add_comment_to_incident": [
+ "Succeeded"
+ ]
+ },
+ "type": "ApiConnection",
+ "inputs": {
+ "body": {
+ "incidentArmId": "@triggerBody()?['object']?['id']",
+ "tagsToAdd": {
+ "TagsToAdd": [
+ {
+ "Tag": "@items('For_each_Threat_IoC')?['type']"
+ },
+ {
+ "Tag": "Imported: @{items('For_each_Threat_IoC')?['imported']}"
+ },
+ {
+ "Tag": "Profile: @{items('For_each_Threat_IoC')?['profile']}"
+ },
+ {
+ "Tag": "Property: @{items('For_each_Threat_IoC')?['property']}"
+ },
+ {
+ "Tag": "Threat Level: @{items('For_each_Threat_IoC')?['threat_level']}"
+ }
+ ]
+ }
+ },
+ "host": {
+ "connection": {
+ "name": "@parameters('$connections')['azuresentinel']['connectionId']"
+ }
+ },
+ "method": "put",
+ "path": "/Incidents"
+ }
+ }
+ }
+ },
+ "expression": {
+ "and": [
+ {
+ "equals": [
+ "@body('Parse_JSON')?['record_count']",
+ 0
+ ]
+ }
+ ]
+ },
+ "type": "If"
+ }
+ },
+ "runAfter": {
+ "Parse_JSON": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "HTTP_-_Get_TIDE_Data_(Hosts)": {
+ "type": "Http",
+ "inputs": {
+ "headers": {
+ "Authorization": "Token @{parameters('TIDE API Key')}"
+ },
+ "method": "GET",
+ "queries": {
+ "host": "@items('For_each_DNS_Domain_Entity')?['DomainName']",
+ "rlimit": "1"
+ },
+ "uri": "https://csp.infoblox.com/tide/api/data/threats"
+ }
+ },
+ "Parse_JSON": {
+ "runAfter": {
+ "HTTP_-_Get_TIDE_Data_(Hosts)": [
+ "Succeeded"
+ ]
+ },
+ "type": "ParseJson",
+ "inputs": {
+ "content": "@body('HTTP_-_Get_TIDE_Data_(Hosts)')",
+ "schema": {
+ "properties": {
+ "record_count": {
+ "type": "integer"
+ },
+ "threat": {
+ "items": {
+ "properties": {
+ "batch_id": {
+ "type": "string"
+ },
+ "class": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "integer"
+ },
+ "confidence_score": {
+ "type": "number"
+ },
+ "confidence_score_rating": {
+ "type": "string"
+ },
+ "confidence_score_vector": {
+ "type": "string"
+ },
+ "detected": {
+ "type": "string"
+ },
+ "domain": {
+ "type": "string"
+ },
+ "email": {
+ "type": "string"
+ },
+ "expiration": {
+ "type": "string"
+ },
+ "extended": {
+ "properties": {
+ "ais_consent": {
+ "type": "string"
+ },
+ "cyberint_guid": {
+ "type": "string"
+ },
+ "no_whitelist": {
+ "type": "string"
+ },
+ "notes": {
+ "type": "string"
+ },
+ "protocol": {
+ "type": "string"
+ },
+ "url_hash": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "hash": {
+ "type": "string"
+ },
+ "hash_type": {
+ "type": "string"
+ },
+ "host": {
+ "type": "string"
+ },
+ "id": {
+ "type": "string"
+ },
+ "imported": {
+ "type": "string"
+ },
+ "ip": {
+ "type": "string"
+ },
+ "profile": {
+ "type": "string"
+ },
+ "property": {
+ "type": "string"
+ },
+ "received": {
+ "type": "string"
+ },
+ "risk_score": {
+ "type": "number"
+ },
+ "risk_score_rating": {
+ "type": "string"
+ },
+ "risk_score_vector": {
+ "type": "string"
+ },
+ "threat_level": {
+ "type": "integer"
+ },
+ "threat_score": {
+ "type": "number"
+ },
+ "threat_score_rating": {
+ "type": "string"
+ },
+ "threat_score_vector": {
+ "type": "string"
+ },
+ "tld": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ },
+ "url": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "id"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ }
+ }
+ }
+ },
+ "runAfter": {
+ "Entities_-_Get_DNS": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "Initialize_HTML": {
+ "type": "InitializeVariable",
+ "inputs": {
+ "variables": [
+ {
+ "name": "html",
+ "type": "string"
+ }
+ ]
+ }
+ }
+ }
+ },
+ "parameters": {
+ "$connections": {
+ "value": {
+ "azuresentinel": {
+ "connectionId": "[[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]",
+ "connectionName": "[[variables('MicrosoftSentinelConnectionName')]",
+ "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/Azuresentinel')]",
+ "connectionProperties": {
+ "authentication": {
+ "type": "ManagedServiceIdentity"
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "name": "[[parameters('PlaybookName')]",
+ "type": "Microsoft.Logic/workflows",
+ "location": "[[variables('workspace-location-inline')]",
+ "tags": {
+ "hidden-SentinelTemplateName": "Infoblox-Incident-Enrichment-Domains",
+ "hidden-SentinelTemplateVersion": "1.0",
+ "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]"
+ },
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "apiVersion": "2017-07-01",
+ "dependsOn": [
+ "[[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]"
+ ]
+ },
+ {
+ "type": "Microsoft.Web/connections",
+ "apiVersion": "2016-06-01",
+ "name": "[[variables('MicrosoftSentinelConnectionName')]",
+ "location": "[[variables('workspace-location-inline')]",
+ "kind": "V1",
+ "properties": {
+ "displayName": "[[variables('MicrosoftSentinelConnectionName')]",
+ "parameterValueType": "Alternative",
+ "api": {
+ "id": "[[variables('_connection-2')]"
+ }
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId10'),'/'))))]",
+ "properties": {
+ "parentId": "[variables('playbookId10')]",
+ "contentId": "[variables('_playbookContentId10')]",
+ "kind": "Playbook",
+ "version": "[variables('playbookVersion10')]",
+ "source": {
+ "kind": "Solution",
+ "name": "Infoblox Cloud Data Connector",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Infoblox",
+ "tier": "Partner",
+ "link": "https://support.infoblox.com/"
+ }
+ }
+ }
+ ],
+ "metadata": {
+ "title": "Infoblox Incident Enrichment Domains",
+ "description": "Leverages the Infoblox TIDE API to enrich Microsoft Sentinel incidents with detailed TIDE data. This playbook can be configured to run automatically when an incident occurs (recommended) or run on demand.",
+ "prerequisites": [
+ "Infoblox TIDE API key."
+ ],
+ "postDeployment": [
+ "1. Grant playbook's Managed Identity **Microsoft Sentinel Responder** or greater to Resource Group.",
+ "2. Authorize connections."
+ ],
+ "lastUpdateTime": "2023-08-07T00:00:00Z",
+ "entities": [
+ "DnsResolution"
+ ],
+ "tags": [
+ "Enrichment"
+ ],
+ "releaseNotes": {
+ "version": "1.0",
+ "title": "[variables('blanks')]",
+ "notes": [
+ "Initial version"
+ ]
+ }
+ }
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('_playbookContentId10')]",
+ "contentKind": "Playbook",
+ "displayName": "Infoblox-Incident-Enrichment-Domains",
+ "contentProductId": "[variables('_playbookcontentProductId10')]",
+ "id": "[variables('_playbookcontentProductId10')]",
+ "version": "[variables('playbookVersion10')]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('playbookTemplateSpecName11')]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "Infoblox-Incident-Send-Email Playbook with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('playbookVersion11')]",
+ "parameters": {
+ "PlaybookName": {
+ "defaultValue": "Infoblox-Incident-Send-Email",
+ "type": "string"
+ },
+ "Email Recipient": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Email Recipient"
+ }
+ },
+ "TIDE API Key": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for TIDE API Key"
+ }
+ }
+ },
+ "variables": {
+ "MicrosoftSentinelConnectionName": "[[concat('MicrosoftSentinel-', parameters('PlaybookName'))]",
+ "Office365ConnectionName": "[[concat('Office365-', parameters('PlaybookName'))]",
+ "connection-2": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/Azuresentinel')]",
+ "_connection-2": "[[variables('connection-2')]",
+ "connection-3": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/Office365')]",
+ "_connection-3": "[[variables('connection-3')]",
+ "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]",
+ "workspace-name": "[parameters('workspace')]",
+ "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]"
+ },
+ "resources": [
+ {
+ "properties": {
+ "provisioningState": "Succeeded",
+ "state": "Disabled",
+ "definition": {
+ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "$connections": {
+ "type": "Object"
+ },
+ "Email Recipient": {
+ "defaultValue": "[[parameters('Email Recipient')]",
+ "type": "string"
+ },
+ "TIDE API Key": {
+ "defaultValue": "[[parameters('TIDE API Key')]",
+ "type": "string"
+ }
+ },
+ "triggers": {
+ "Microsoft_Sentinel_incident": {
+ "type": "ApiConnectionWebhook",
+ "inputs": {
+ "body": {
+ "callback_url": "@{listCallbackUrl()}"
+ },
+ "host": {
+ "connection": {
+ "name": "@parameters('$connections')['azuresentinel']['connectionId']"
+ }
+ },
+ "path": "/incident-creation"
+ }
+ }
+ },
+ "actions": {
+ "Create_HTML_table_with_Entities": {
+ "runAfter": {
+ "Select_Entities": [
+ "Succeeded"
+ ]
+ },
+ "type": "Table",
+ "inputs": {
+ "format": "HTML",
+ "from": "@body('Select_Entities')"
+ }
+ },
+ "Entities_-_Get_DNS": {
+ "runAfter": {
+ "Set_Entities_HTML": [
+ "Succeeded"
+ ]
+ },
+ "type": "ApiConnection",
+ "inputs": {
+ "body": "@triggerBody()?['object']?['properties']?['relatedEntities']",
+ "host": {
+ "connection": {
+ "name": "@parameters('$connections')['azuresentinel']['connectionId']"
+ }
+ },
+ "method": "post",
+ "path": "/entities/dnsresolution"
+ }
+ },
+ "For_each_DNS_Domain_Entity": {
+ "foreach": "@body('Entities_-_Get_DNS')?['Dnsresolutions']",
+ "actions": {
+ "For_each_Threat_IoC": {
+ "foreach": "@body('Parse_JSON')?['threat']",
+ "actions": {
+ "Enrich_Email_with_TIDE_Data_if_it_exists": {
+ "else": {
+ "actions": {
+ "Append_HTML_Table_with_TIDE_Data": {
+ "type": "AppendToStringVariable",
+ "inputs": {
+ "name": "html_tide",
+ "value": "\nIoC - @{items('For_each_DNS_Domain_Entity')?['DomainName']} - @{items('For_each_Threat_IoC')?['type']} - @{items('For_each_Threat_IoC')?['class']}
\n \n\n| ID | \n@{items('For_each_Threat_IoC')?['id']} | \n
\n\n| Type | \n@{items('For_each_Threat_IoC')?['type']} | \n
\n\n| Host | \n@{items('For_each_Threat_IoC')?['host']} | \n
\n\n| Domain | \n@{items('For_each_Threat_IoC')?['domain']} | \n
\n\n| URL | \n@{items('For_each_Threat_IoC')?['url']} | \n
\n\n| IP | \n@{items('For_each_Threat_IoC')?['ip']} | \n
\nEmail | \n@{items('For_each_Threat_IoC')?['email']} | \n\n\n| Hash | \n@{items('For_each_Threat_IoC')?['hash']} @{items('For_each_Threat_IoC')?['hash_type']} | \n
\n\n| Profile | \n@{items('For_each_Threat_IoC')?['profile']} | \n
\n\n| Property | \n@{items('For_each_Threat_IoC')?['property']} | \n
\n\n| Threat Level | \n@{items('For_each_Threat_IoC')?['threat_level']} | \n
\n\n| Confidence | \n@{items('For_each_Threat_IoC')?['confidence']} | \n
\n\n| Detected | \n@{items('For_each_Threat_IoC')?['detected']} | \n
\n\n| Received | \n@{items('For_each_Threat_IoC')?['received']} | \n
\n\n| Imported | \n@{items('For_each_Threat_IoC')?['imported']} | \n
\n\n| Expiration | \n@{items('For_each_Threat_IoC')?['expiration']} | \n
\n\n| Description | \n@{items('For_each_Threat_IoC')?['extended']?['notes']} | \n
\n\n| Open in CSP | \nhttps://csp.infoblox.com/#/security_research/search/auto/@{items('For_each_Threat_IoC')?['host']}/summary | \n
\n\n
"
+ }
+ }
+ }
+ },
+ "expression": {
+ "and": [
+ {
+ "equals": [
+ "@body('Parse_JSON')?['record_count']",
+ 0
+ ]
+ }
+ ]
+ },
+ "type": "If"
+ }
+ },
+ "runAfter": {
+ "Parse_JSON": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "HTTP_-_Get_TIDE_Data_(Hosts)": {
+ "type": "Http",
+ "inputs": {
+ "headers": {
+ "Authorization": "Token @{parameters('TIDE API Key')}"
+ },
+ "method": "GET",
+ "queries": {
+ "host": "@items('For_each_DNS_Domain_Entity')?['DomainName']",
+ "rlimit": "1"
+ },
+ "uri": "https://csp.infoblox.com/tide/api/data/threats"
+ }
+ },
+ "Parse_JSON": {
+ "runAfter": {
+ "HTTP_-_Get_TIDE_Data_(Hosts)": [
+ "Succeeded"
+ ]
+ },
+ "type": "ParseJson",
+ "inputs": {
+ "content": "@body('HTTP_-_Get_TIDE_Data_(Hosts)')",
+ "schema": {
+ "properties": {
+ "record_count": {
+ "type": "integer"
+ },
+ "threat": {
+ "items": {
+ "properties": {
+ "batch_id": {
+ "type": "string"
+ },
+ "class": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "integer"
+ },
+ "confidence_score": {
+ "type": "number"
+ },
+ "confidence_score_rating": {
+ "type": "string"
+ },
+ "confidence_score_vector": {
+ "type": "string"
+ },
+ "detected": {
+ "type": "string"
+ },
+ "domain": {
+ "type": "string"
+ },
+ "email": {
+ "type": "string"
+ },
+ "expiration": {
+ "type": "string"
+ },
+ "extended": {
+ "properties": {
+ "ais_consent": {
+ "type": "string"
+ },
+ "cyberint_guid": {
+ "type": "string"
+ },
+ "no_whitelist": {
+ "type": "string"
+ },
+ "notes": {
+ "type": "string"
+ },
+ "protocol": {
+ "type": "string"
+ },
+ "url_hash": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "hash": {
+ "type": "string"
+ },
+ "hash_type": {
+ "type": "string"
+ },
+ "host": {
+ "type": "string"
+ },
+ "id": {
+ "type": "string"
+ },
+ "imported": {
+ "type": "string"
+ },
+ "ip": {
+ "type": "string"
+ },
+ "profile": {
+ "type": "string"
+ },
+ "property": {
+ "type": "string"
+ },
+ "received": {
+ "type": "string"
+ },
+ "risk_score": {
+ "type": "number"
+ },
+ "risk_score_rating": {
+ "type": "string"
+ },
+ "risk_score_vector": {
+ "type": "string"
+ },
+ "threat_level": {
+ "type": "integer"
+ },
+ "threat_score": {
+ "type": "number"
+ },
+ "threat_score_rating": {
+ "type": "string"
+ },
+ "threat_score_vector": {
+ "type": "string"
+ },
+ "tld": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ },
+ "url": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "id"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ }
+ }
+ }
+ },
+ "runAfter": {
+ "Entities_-_Get_DNS": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "Initialize_CSS": {
+ "runAfter": {
+ "Initialize_Incident_HTML": [
+ "Succeeded"
+ ]
+ },
+ "type": "InitializeVariable",
+ "inputs": {
+ "variables": [
+ {
+ "name": "css",
+ "type": "string",
+ "value": ".title {\n color: #1F2A47;\n font-size: 2rem;\n letter-spacing: .04em;\n padding: 8px;\n border-bottom: 1px solid #7B7B7B;\n font-weight: bold;\n}\n\ntable {\n border-collapse: collapse;\n border-spacing: 0;\n padding: 0;\n margin: 0 0 20px;\n}\n\n.tkey {\n text-align: right;\n border-right: 1px solid #7B7B7B;\n}\n.tvalue {\n text-align: left;\n border-top: 1px solid #eee !important;\n padding-left: 10px;\n}\n.value {\n font-size: 1.4rem;\n font-weight: bold;\n}\n\n.tkey, .key{\n color: #263137;\n letter-spacing: .04em;\n font-style: italic;\n padding-right: 10px;\n}\n.tvalue, .value {\n color: #1f4728 !important;\n letter-spacing: .02rem;\n}\n\n"
+ }
+ ]
+ }
+ },
+ "Initialize_Entities_HTML": {
+ "runAfter": {
+ "Initialize_CSS": [
+ "Succeeded"
+ ]
+ },
+ "type": "InitializeVariable",
+ "inputs": {
+ "variables": [
+ {
+ "name": "html_entities",
+ "type": "string"
+ }
+ ]
+ }
+ },
+ "Initialize_Incident_HTML": {
+ "runAfter": {
+ "Initialize_TIDE_HTML": [
+ "Succeeded"
+ ]
+ },
+ "type": "InitializeVariable",
+ "inputs": {
+ "variables": [
+ {
+ "name": "html_incident",
+ "type": "string"
+ }
+ ]
+ }
+ },
+ "Initialize_TIDE_HTML": {
+ "type": "InitializeVariable",
+ "inputs": {
+ "variables": [
+ {
+ "name": "html_tide",
+ "type": "string"
+ }
+ ]
+ }
+ },
+ "Select_Entities": {
+ "runAfter": {
+ "Initialize_Entities_HTML": [
+ "Succeeded"
+ ]
+ },
+ "type": "Select",
+ "inputs": {
+ "from": "@triggerBody()?['object']?['properties']?['relatedEntities']",
+ "select": {
+ "Entity": "@item()?['properties']?['friendlyName']",
+ "Type": "@item()?['kind']"
+ }
+ }
+ },
+ "Send_an_email_with_Incident_details": {
+ "runAfter": {
+ "Set_Incident_HTML": [
+ "Succeeded"
+ ]
+ },
+ "type": "ApiConnection",
+ "inputs": {
+ "body": {
+ "Body": "@{variables('html_incident')}
\n@{variables('html_tide')}
",
+ "Importance": "Normal",
+ "Subject": "New Sentinel Incident - @{triggerBody()?['object']?['properties']?['title']}",
+ "To": "@parameters('Email Recipient')"
+ },
+ "host": {
+ "connection": {
+ "name": "@parameters('$connections')['office365_1']['connectionId']"
+ }
+ },
+ "method": "post",
+ "path": "/v2/Mail"
+ }
+ },
+ "Set_Entities_HTML": {
+ "runAfter": {
+ "Create_HTML_table_with_Entities": [
+ "Succeeded"
+ ]
+ },
+ "type": "SetVariable",
+ "inputs": {
+ "name": "html_entities",
+ "value": "\n@{body('Create_HTML_table_with_Entities')}\n"
+ }
+ },
+ "Set_Incident_HTML": {
+ "runAfter": {
+ "For_each_DNS_Domain_Entity": [
+ "Succeeded"
+ ]
+ },
+ "type": "SetVariable",
+ "inputs": {
+ "name": "html_incident",
+ "value": "\n New incident created in Microsoft Sentinel
\n\n Triggered - @{triggerBody()?['object']?['properties']?['title']}
\n\n Incident ID - @{triggerBody()?['object']?['properties']?['incidentNumber']}
\n\n Triggered on - @{triggerBody()?['object']?['properties']?['createdTimeUtc']}
\n\n Severity - @{triggerBody()?['object']?['properties']?['severity']}
\n\n Alert providers - @{join(triggerBody()?['object']?['properties']?['additionalData']?['alertProductNames'], '
')}
\n\n Tactics - \n@{join(triggerBody()?['object']?['properties']?['additionalData']?['tactics'], '
')}
\n\n Description - \n@{triggerBody()?['object']?['properties']?['description']}
\n\n Entities - \n@{variables('html_entities')}
\n\n Incident link - \n@{triggerBody()?['object']?['properties']?['incidentUrl']}
\n\n TIDE Data
"
+ }
+ }
+ }
+ },
+ "parameters": {
+ "$connections": {
+ "value": {
+ "azuresentinel": {
+ "connectionId": "[[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]",
+ "connectionName": "[[variables('MicrosoftSentinelConnectionName')]",
+ "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/Azuresentinel')]",
+ "connectionProperties": {
+ "authentication": {
+ "type": "ManagedServiceIdentity"
+ }
+ }
+ },
+ "office365_1": {
+ "connectionId": "[[resourceId('Microsoft.Web/connections', variables('Office365ConnectionName'))]",
+ "connectionName": "[[variables('Office365ConnectionName')]",
+ "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/Office365')]"
+ }
+ }
+ }
+ }
+ },
+ "name": "[[parameters('PlaybookName')]",
+ "type": "Microsoft.Logic/workflows",
+ "location": "[[variables('workspace-location-inline')]",
+ "tags": {
+ "hidden-SentinelTemplateName": "Infoblox-Incident-Send-Email",
+ "hidden-SentinelTemplateVersion": "1.0",
+ "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]"
+ },
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "apiVersion": "2017-07-01",
+ "dependsOn": [
+ "[[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]",
+ "[[resourceId('Microsoft.Web/connections', variables('Office365ConnectionName'))]"
+ ]
+ },
+ {
+ "type": "Microsoft.Web/connections",
+ "apiVersion": "2016-06-01",
+ "name": "[[variables('MicrosoftSentinelConnectionName')]",
+ "location": "[[variables('workspace-location-inline')]",
+ "kind": "V1",
+ "properties": {
+ "displayName": "[[variables('MicrosoftSentinelConnectionName')]",
+ "parameterValueType": "Alternative",
+ "api": {
+ "id": "[[variables('_connection-2')]"
+ }
+ }
+ },
+ {
+ "type": "Microsoft.Web/connections",
+ "apiVersion": "2016-06-01",
+ "name": "[[variables('Office365ConnectionName')]",
+ "location": "[[variables('workspace-location-inline')]",
+ "kind": "V1",
+ "properties": {
+ "displayName": "[[variables('Office365ConnectionName')]",
+ "api": {
+ "id": "[[variables('_connection-3')]"
+ }
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId11'),'/'))))]",
+ "properties": {
+ "parentId": "[variables('playbookId11')]",
+ "contentId": "[variables('_playbookContentId11')]",
+ "kind": "Playbook",
+ "version": "[variables('playbookVersion11')]",
+ "source": {
+ "kind": "Solution",
+ "name": "Infoblox Cloud Data Connector",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Infoblox",
+ "tier": "Partner",
+ "link": "https://support.infoblox.com/"
+ }
+ }
+ }
+ ],
+ "metadata": {
+ "title": "Infoblox Incident Send Email",
+ "description": "Sends a detailed email when an incident occurs. Optionally enriches an applicable entity within the email with Infoblox TIDE data. This playbook can be configured to run automatically when an incident occurs (recommended) or run on demand.",
+ "prerequisites": [
+ "Infoblox TIDE API key (optional)."
+ ],
+ "postDeployment": [
+ "1. Grant playbook's Managed Identity **Microsoft Sentinel Responder** or greater to Resource Group.",
+ "2. Authorize connections."
+ ],
+ "lastUpdateTime": "2023-08-07T00:00:00Z",
+ "entities": [
+ "DnsResolution"
+ ],
+ "tags": [
+ "Enrichment",
+ "Notification"
+ ],
+ "releaseNotes": {
+ "version": "1.0",
+ "title": "[variables('blanks')]",
+ "notes": [
+ "Initial version"
+ ]
+ }
+ }
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('_playbookContentId11')]",
+ "contentKind": "Playbook",
+ "displayName": "Infoblox-Incident-Send-Email",
+ "contentProductId": "[variables('_playbookcontentProductId11')]",
+ "id": "[variables('_playbookcontentProductId11')]",
+ "version": "[variables('playbookVersion11')]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages",
+ "apiVersion": "2023-04-01-preview",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "version": "3.0.0",
+ "kind": "Solution",
+ "contentSchemaVersion": "3.0.0",
+ "displayName": "Infoblox Cloud Data Connector",
+ "publisherDisplayName": "Infoblox",
+ "descriptionHtml": "Note: There may be known issues pertaining to this Solution, please refer to them before installing.
\nThe Infoblox Cloud solution allows you to easily connect your Infoblox BloxOne data with Microsoft Sentinel. By connecting your logs to Microsoft Sentinel, you can take advantage of search & correlation, alerting, and threat intelligence enrichment for each log.
\nUnderlying Microsoft Technologies used:
\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:
\n\n- Agent based logs collection from Windows and Linux machines
\n
\nData Connectors: 1, Parsers: 1, Workbooks: 1, Analytic Rules: 8, Playbooks: 11
\nLearn more about Microsoft Sentinel | Learn more about Solutions
\n",
+ "contentKind": "Solution",
+ "contentProductId": "[variables('_solutioncontentProductId')]",
+ "id": "[variables('_solutioncontentProductId')]",
+ "icon": "![](\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/infoblox_logo.svg\")
",
+ "contentId": "[variables('_solutionId')]",
+ "parentId": "[variables('_solutionId')]",
+ "source": {
+ "kind": "Solution",
+ "name": "Infoblox Cloud Data Connector",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Infoblox",
+ "tier": "Partner",
+ "link": "https://support.infoblox.com/"
+ },
+ "dependencies": {
+ "operator": "AND",
+ "criteria": [
+ {
+ "kind": "Workbook",
+ "contentId": "[variables('_workbookContentId1')]",
+ "version": "[variables('workbookVersion1')]"
+ },
+ {
+ "kind": "AnalyticsRule",
+ "contentId": "[variables('analyticRulecontentId1')]",
+ "version": "[variables('analyticRuleVersion1')]"
+ },
+ {
+ "kind": "AnalyticsRule",
+ "contentId": "[variables('analyticRulecontentId2')]",
+ "version": "[variables('analyticRuleVersion2')]"
+ },
+ {
+ "kind": "AnalyticsRule",
+ "contentId": "[variables('analyticRulecontentId3')]",
+ "version": "[variables('analyticRuleVersion3')]"
+ },
+ {
+ "kind": "AnalyticsRule",
+ "contentId": "[variables('analyticRulecontentId4')]",
+ "version": "[variables('analyticRuleVersion4')]"
+ },
+ {
+ "kind": "AnalyticsRule",
+ "contentId": "[variables('analyticRulecontentId5')]",
+ "version": "[variables('analyticRuleVersion5')]"
+ },
+ {
+ "kind": "AnalyticsRule",
+ "contentId": "[variables('analyticRulecontentId6')]",
+ "version": "[variables('analyticRuleVersion6')]"
+ },
+ {
+ "kind": "AnalyticsRule",
+ "contentId": "[variables('analyticRulecontentId7')]",
+ "version": "[variables('analyticRuleVersion7')]"
+ },
+ {
+ "kind": "AnalyticsRule",
+ "contentId": "[variables('analyticRulecontentId8')]",
+ "version": "[variables('analyticRuleVersion8')]"
+ },
+ {
+ "kind": "DataConnector",
+ "contentId": "[variables('_dataConnectorContentId1')]",
+ "version": "[variables('dataConnectorVersion1')]"
+ },
+ {
+ "kind": "Parser",
+ "contentId": "[variables('_parserContentId1')]",
+ "version": "[variables('parserVersion1')]"
+ },
+ {
+ "kind": "Playbook",
+ "contentId": "[variables('_Infoblox-Import-AISCOMM-Weekly')]",
+ "version": "[variables('playbookVersion1')]"
+ },
+ {
+ "kind": "Playbook",
+ "contentId": "[variables('_Infoblox-Import-Emails-Weekly')]",
+ "version": "[variables('playbookVersion2')]"
+ },
+ {
+ "kind": "Playbook",
+ "contentId": "[variables('_Infoblox-Import-Hashes-Weekly')]",
+ "version": "[variables('playbookVersion3')]"
+ },
+ {
+ "kind": "Playbook",
+ "contentId": "[variables('_Infoblox-Import-Hosts-Daily-LookalikeDomains')]",
+ "version": "[variables('playbookVersion4')]"
+ },
+ {
+ "kind": "Playbook",
+ "contentId": "[variables('_Infoblox-Import-Hosts-Daily-MalwareC2DGA')]",
+ "version": "[variables('playbookVersion5')]"
+ },
+ {
+ "kind": "Playbook",
+ "contentId": "[variables('_Infoblox-Import-Hosts-Daily-Phishing')]",
+ "version": "[variables('playbookVersion6')]"
+ },
+ {
+ "kind": "Playbook",
+ "contentId": "[variables('_Infoblox-Import-Hosts-Hourly')]",
+ "version": "[variables('playbookVersion7')]"
+ },
+ {
+ "kind": "Playbook",
+ "contentId": "[variables('_Infoblox-Import-IPs-Hourly')]",
+ "version": "[variables('playbookVersion8')]"
+ },
+ {
+ "kind": "Playbook",
+ "contentId": "[variables('_Infoblox-Import-URLs-Hourly')]",
+ "version": "[variables('playbookVersion9')]"
+ },
+ {
+ "kind": "Playbook",
+ "contentId": "[variables('_Infoblox-Incident-Enrichment-Domains')]",
+ "version": "[variables('playbookVersion10')]"
+ },
+ {
+ "kind": "Playbook",
+ "contentId": "[variables('_Infoblox-Incident-Send-Email')]",
+ "version": "[variables('playbookVersion11')]"
+ }
+ ]
+ },
+ "firstPublishDate": "2021-10-20",
+ "providers": [
+ "Infoblox"
+ ],
+ "categories": {
+ "domains": [
+ "Networking",
+ "Security - Threat Protection",
+ "Security - Network",
+ "Security - Threat Intelligence"
+ ]
+ }
+ },
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]"
+ }
+ ],
+ "outputs": {}
+}
diff --git a/Solutions/Infoblox Cloud Data Connector/Parsers/InfobloxCDC.txt b/Solutions/Infoblox Cloud Data Connector/Parsers/InfobloxCDC.txt
deleted file mode 100644
index d4cf22a5375..00000000000
--- a/Solutions/Infoblox Cloud Data Connector/Parsers/InfobloxCDC.txt
+++ /dev/null
@@ -1,52 +0,0 @@
-// Title: Infoblox Cloud Data Connector Parser
-// Author: Infoblox
-// Version: 2.0.9
-// Last Updated: 4/10/2023
-// Comment:
-//
-// DESCRIPTION:
-// This parser takes raw Infoblox Cloud Data Connector (CDC) logs from a Syslog (CEF) stream and parses the logs into a normalized schema.
-//
-// USAGE:
-// 1. Open Log Analytics/Microsoft Sentinel Logs blade. Copy the query below and paste into the Logs query window.
-// 2. Click the Save button above the query. A pane will appear on the right, select "as Function" from the drop down. Enter the Function Name as InfobloxCDC.
-// 3. Kusto Functions can typically take up to 15 minutes to activate. You can then use Function Alias for other queries.
-//
-// REFERENCES:
-// Using functions in Azure monitor log queries: https://docs.microsoft.com/azure/azure-monitor/log-query/functions
-//
-CommonSecurityLog
-| where DeviceVendor == "Infoblox" and DeviceProduct == "Data Connector"
-| extend AEcopy = AdditionalExtensions
-//Remove DHCP Option codes at end of DHCP logs to prevent invalid chars in fieldnames, causing errors. If you require these advanced fields, remove the following line.
-| extend AEcopy = trim_end("InfobloxDHCPOptions=;(.*?)",AEcopy)
-| extend AEcopy = extract_all(@"(?P[^=;]+)=(?P[^=;]+)", dynamic(["key","value"]), AEcopy)
-| mv-apply AEcopy on (
- summarize AdditionalExtensionsParsedNested = make_bag(pack(tostring(AEcopy[0]), AEcopy[1]))
-)
-| extend AdditionalExtensionsParsed = AdditionalExtensionsParsedNested
-| evaluate bag_unpack(AdditionalExtensionsParsed)
-| extend ThreatLevel_Score = toint(column_ifexists("InfobloxThreatLevel", ""))
-| extend ThreatLevel = case(ThreatLevel_Score>=80, "High",
- ThreatLevel_Score>=30 and ThreatLevel_Score<80, "Medium",
- ThreatLevel_Score<30 and ThreatLevel_Score>=1, "Low",
- ThreatLevel_Score == 0,"Info",
- "N/A" )
-| extend ThreatClass = extract("(.*?)_", 1, tostring(column_ifexists("InfobloxThreatProperty", "")))
-| extend ThreatProperty = extract("([^_]*$)", 1, tostring(column_ifexists("InfobloxThreatProperty", "")))
-| extend InfobloxB1FeedName = column_ifexists("InfobloxB1FeedName", "")
-| extend InfobloxRPZ = column_ifexists("InfobloxRPZ", "")
-| extend InfobloxB1PolicyAction = column_ifexists("InfobloxB1PolicyAction", "")
-| extend InfobloxB1PolicyName = column_ifexists("InfobloxB1PolicyName", "")
-| extend InfobloxDomainCat = column_ifexists("InfobloxDomainCat", "")
-| extend InfobloxB1ConnectionType = column_ifexists("InfobloxB1ConnectionType", "")
-| extend InfobloxB1SrcOSVersion = column_ifexists("InfobloxB1SrcOSVersion", "")
-| extend InfobloxB1Network = column_ifexists("InfobloxB1Network", "")
-| extend DeviceName = column_ifexists("DeviceName", "")
-| extend SourceMACAddress = column_ifexists("SourceMACAddress", "")
-| extend InfobloxLeaseOp = column_ifexists("InfobloxLeaseOp", "")
-| extend InfobloxLifetime = column_ifexists("InfobloxLifetime", "")
-| extend InfobloxLeaseUUID = column_ifexists("InfobloxLeaseUUID", "")
-| extend InfobloxDNSRCode = column_ifexists("InfobloxDNSRCode", "")
-| extend InfobloxDNSQClass = column_ifexists("InfobloxDNSQClass", "")
-| extend InfobloxDNSQType = column_ifexists("InfobloxDNSQType", "")
diff --git a/Solutions/Infoblox Cloud Data Connector/Parsers/InfobloxCDC.yaml b/Solutions/Infoblox Cloud Data Connector/Parsers/InfobloxCDC.yaml
index 147eceea09e..0ca20c60e5b 100644
--- a/Solutions/Infoblox Cloud Data Connector/Parsers/InfobloxCDC.yaml
+++ b/Solutions/Infoblox Cloud Data Connector/Parsers/InfobloxCDC.yaml
@@ -14,7 +14,7 @@ FunctionQuery: |
| extend AEcopy = trim_end("InfobloxDHCPOptions=;(.*?)",AEcopy)
| extend AEcopy = extract_all(@"(?P[^=;]+)=(?P[^=;]+)", dynamic(["key","value"]), AEcopy)
| mv-apply AEcopy on (
- summarize AdditionalExtensionsParsedNested = make_bag(pack(tostring(AEcopy[0]), AEcopy[1]))
+ summarize AdditionalExtensionsParsedNested = make_bag(bag_pack(tostring(AEcopy[0]), AEcopy[1]))
)
| extend AdditionalExtensionsParsed = AdditionalExtensionsParsedNested
| evaluate bag_unpack(AdditionalExtensionsParsed)
@@ -41,4 +41,6 @@ FunctionQuery: |
| extend InfobloxLeaseUUID = column_ifexists("InfobloxLeaseUUID", "")
| extend InfobloxDNSRCode = column_ifexists("InfobloxDNSRCode", "")
| extend InfobloxDNSQClass = column_ifexists("InfobloxDNSQClass", "")
- | extend InfobloxDNSQType = column_ifexists("InfobloxDNSQType", "")
\ No newline at end of file
+ | extend InfobloxDNSQType = column_ifexists("InfobloxDNSQType", "")
+ | extend InfobloxThreatConfidence = toint(column_ifexists("InfobloxThreatConfidence", ""))
+ | extend ThreatConfidence = toint(column_ifexists("InfobloxThreatConfidence", ""))
\ No newline at end of file
diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-AISCOMM-Weekly/azuredeploy.json b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-AISCOMM-Weekly/azuredeploy.json
new file mode 100644
index 00000000000..6638e0488ab
--- /dev/null
+++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-AISCOMM-Weekly/azuredeploy.json
@@ -0,0 +1,518 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "1.0.0.0",
+ "metadata": {
+ "title": "Infoblox Import AISCOMM Weekly",
+ "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports all indicators from the AISCOMM data provider on a scheduled weekly basis.",
+ "prerequisites": [
+ "Infoblox TIDE API key."
+ ],
+ "postDeployment": [
+ "Authorize connections."
+ ],
+ "prerequisitesDeployTemplateFile": "",
+ "lastUpdateTime": "2023-08-07T00:00:00.000Z",
+ "entities": [
+ ],
+ "tags": [
+ ],
+ "support": {
+ "tier": "community",
+ "armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator"
+ },
+ "author": {
+ "name": "Infoblox"
+ }
+ },
+ "parameters": {
+ "PlaybookName": {
+ "defaultValue": "Infoblox-Import-AISCOMM-Weekly",
+ "type": "string"
+ },
+ "AD Application Secret": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for AD Application Secret"
+ }
+ },
+ "Client ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Client ID"
+ }
+ },
+ "TIDE API Key": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for TIDE API Key"
+ }
+ },
+ "Tenant ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Tenant ID"
+ }
+ }
+ },
+ "variables": {
+ },
+ "resources": [
+ {
+ "properties": {
+ "provisioningState": "Succeeded",
+ "state": "Disabled",
+ "definition": {
+ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "AD Application Secret": {
+ "defaultValue": "[parameters('AD Application Secret')]",
+ "type": "string"
+ },
+ "Client ID": {
+ "defaultValue": "[parameters('Client ID')]",
+ "type": "string"
+ },
+ "TIDE API Key": {
+ "defaultValue": "[parameters('TIDE API Key')]",
+ "type": "string"
+ },
+ "Tenant ID": {
+ "defaultValue": "[parameters('Tenant ID')]",
+ "type": "string"
+ }
+ },
+ "triggers": {
+ "Recurrence": {
+ "recurrence": {
+ "frequency": "Week",
+ "interval": 1
+ },
+ "evaluatedRecurrence": {
+ "frequency": "Week",
+ "interval": 1
+ },
+ "type": "Recurrence"
+ }
+ },
+ "actions": {
+ "For_Each_Indicator_(Threat)": {
+ "foreach": "@body('Parse_JSON')?['threat']",
+ "actions": {
+ "Switch": {
+ "runAfter": {
+ },
+ "cases": {
+ "EMAIL": {
+ "case": "EMAIL",
+ "actions": {
+ "Send_Emails_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}",
+ "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HASH": {
+ "case": "HASH",
+ "actions": {
+ "Send_Hashes_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "fileHashType": "@{toLower(items('For_Each_Indicator_(Threat)')?['hash_type'])}",
+ "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}",
+ "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HOST": {
+ "case": "HOST",
+ "actions": {
+ "Send_Hosts_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "IP": {
+ "case": "IP",
+ "actions": {
+ "Send_IPs_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "URL": {
+ "case": "URL",
+ "actions": {
+ "Send_URLs_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white",
+ "url": "@{items('For_Each_Indicator_(Threat)')?['url']}"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ }
+ },
+ "default": {
+ "actions": {
+ }
+ },
+ "expression": "@items('For_Each_Indicator_(Threat)')?['type']",
+ "type": "Switch"
+ }
+ },
+ "runAfter": {
+ "Parse_JSON": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "Get_TIDE_Data": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "headers": {
+ "Authorization": "Token @{parameters('TIDE API Key')}"
+ },
+ "method": "GET",
+ "queries": {
+ "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url",
+ "profile": "AISCOMM",
+ "rlimit": "90000"
+ },
+ "uri": "https://csp.infoblox.com/tide/api/data/threats/"
+ }
+ },
+ "Parse_JSON": {
+ "runAfter": {
+ "Get_TIDE_Data": [
+ "Succeeded"
+ ]
+ },
+ "type": "ParseJson",
+ "inputs": {
+ "content": "@body('Get_TIDE_Data')",
+ "schema": {
+ "properties": {
+ "record_count": {
+ "type": "integer"
+ },
+ "threat": {
+ "items": {
+ "properties": {
+ "batch_id": {
+ "type": "string"
+ },
+ "class": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "integer"
+ },
+ "confidence_score": {
+ "type": "number"
+ },
+ "confidence_score_rating": {
+ "type": "string"
+ },
+ "confidence_score_vector": {
+ "type": "string"
+ },
+ "detected": {
+ "type": "string"
+ },
+ "dga": {
+ },
+ "domain": {
+ "type": "string"
+ },
+ "email": {
+ "type": "string"
+ },
+ "expiration": {
+ "type": "string"
+ },
+ "extended": {
+ "properties": {
+ "ais_consent": {
+ "type": "string"
+ },
+ "cyberint_guid": {
+ "type": "string"
+ },
+ "no_whitelist": {
+ "type": "string"
+ },
+ "notes": {
+ "type": "string"
+ },
+ "protocol": {
+ "type": "string"
+ },
+ "url_hash": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "hash": {
+ "type": "string"
+ },
+ "hash_type": {
+ "type": "string"
+ },
+ "host": {
+ "type": "string"
+ },
+ "id": {
+ "type": "string"
+ },
+ "imported": {
+ "type": "string"
+ },
+ "ip": {
+ "type": "string"
+ },
+ "profile": {
+ "type": "string"
+ },
+ "property": {
+ "type": "string"
+ },
+ "received": {
+ "type": "string"
+ },
+ "risk_score": {
+ "type": "number"
+ },
+ "risk_score_rating": {
+ "type": "string"
+ },
+ "risk_score_vector": {
+ "type": "string"
+ },
+ "threat_level": {
+ "type": "integer"
+ },
+ "threat_score": {
+ "type": "number"
+ },
+ "threat_score_rating": {
+ "type": "string"
+ },
+ "threat_score_vector": {
+ "type": "string"
+ },
+ "tld": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ },
+ "up": {
+ },
+ "url": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "id"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ }
+ }
+ }
+ },
+ "outputs": {
+ }
+ },
+ "parameters": {
+ }
+ },
+ "name": "[parameters('PlaybookName')]",
+ "type": "Microsoft.Logic/workflows",
+ "location": "[resourceGroup().location]",
+ "tags": {
+ "hidden-SentinelTemplateName": "Infoblox-Import-AISCOMM-Weekly",
+ "hidden-SentinelTemplateVersion": "1.0"
+ },
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "apiVersion": "2017-07-01",
+ "dependsOn": [
+ ]
+ }
+ ]
+}
diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Emails-Weekly/azuredeploy.json b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Emails-Weekly/azuredeploy.json
new file mode 100644
index 00000000000..e18cad3d847
--- /dev/null
+++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Emails-Weekly/azuredeploy.json
@@ -0,0 +1,517 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "1.0.0.0",
+ "metadata": {
+ "title": "Infoblox Import Emails Weekly",
+ "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected emails on a scheduled weekly basis.",
+ "prerequisites": [
+ "Infoblox TIDE API key."
+ ],
+ "postDeployment": [
+ "Authorize connections."
+ ],
+ "prerequisitesDeployTemplateFile": "",
+ "lastUpdateTime": "2023-08-07T00:00:00.000Z",
+ "entities": [
+ ],
+ "tags": [
+ ],
+ "support": {
+ "tier": "community",
+ "armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator"
+ },
+ "author": {
+ "name": "Infoblox"
+ }
+ },
+ "parameters": {
+ "PlaybookName": {
+ "defaultValue": "Infoblox-Import-Emails-Weekly",
+ "type": "string"
+ },
+ "AD Application Secret": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for AD Application Secret"
+ }
+ },
+ "Client ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Client ID"
+ }
+ },
+ "TIDE API Key": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for TIDE API Key"
+ }
+ },
+ "Tenant ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Tenant ID"
+ }
+ }
+ },
+ "variables": {
+ },
+ "resources": [
+ {
+ "properties": {
+ "provisioningState": "Succeeded",
+ "state": "Disabled",
+ "definition": {
+ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "AD Application Secret": {
+ "defaultValue": "[parameters('AD Application Secret')]",
+ "type": "string"
+ },
+ "Client ID": {
+ "defaultValue": "[parameters('Client ID')]",
+ "type": "string"
+ },
+ "TIDE API Key": {
+ "defaultValue": "[parameters('TIDE API Key')]",
+ "type": "string"
+ },
+ "Tenant ID": {
+ "defaultValue": "[parameters('Tenant ID')]",
+ "type": "string"
+ }
+ },
+ "triggers": {
+ "Recurrence": {
+ "recurrence": {
+ "frequency": "Week",
+ "interval": 1
+ },
+ "evaluatedRecurrence": {
+ "frequency": "Week",
+ "interval": 1
+ },
+ "type": "Recurrence"
+ }
+ },
+ "actions": {
+ "For_Each_Indicator_(Threat)": {
+ "foreach": "@body('Parse_JSON')?['threat']",
+ "actions": {
+ "Switch": {
+ "runAfter": {
+ },
+ "cases": {
+ "EMAIL": {
+ "case": "EMAIL",
+ "actions": {
+ "Send_Emails_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}",
+ "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HASH": {
+ "case": "HASH",
+ "actions": {
+ "Send_Hashes_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}",
+ "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}",
+ "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HOST": {
+ "case": "HOST",
+ "actions": {
+ "Send_Hosts_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "IP": {
+ "case": "IP",
+ "actions": {
+ "Send_IPs_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "URL": {
+ "case": "URL",
+ "actions": {
+ "Send_URLs_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white",
+ "url": "@{items('For_Each_Indicator_(Threat)')?['url']}"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ }
+ },
+ "default": {
+ "actions": {
+ }
+ },
+ "expression": "@items('For_Each_Indicator_(Threat)')?['type']",
+ "type": "Switch"
+ }
+ },
+ "runAfter": {
+ "Parse_JSON": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "Get_TIDE_Data": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "headers": {
+ "Authorization": "Token @{parameters('TIDE API Key')}"
+ },
+ "method": "GET",
+ "queries": {
+ "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url",
+ "rlimit": "90000"
+ },
+ "uri": "https://csp.infoblox.com/tide/api/data/threats/email/"
+ }
+ },
+ "Parse_JSON": {
+ "runAfter": {
+ "Get_TIDE_Data": [
+ "Succeeded"
+ ]
+ },
+ "type": "ParseJson",
+ "inputs": {
+ "content": "@body('Get_TIDE_Data')",
+ "schema": {
+ "properties": {
+ "record_count": {
+ "type": "integer"
+ },
+ "threat": {
+ "items": {
+ "properties": {
+ "batch_id": {
+ "type": "string"
+ },
+ "class": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "integer"
+ },
+ "confidence_score": {
+ "type": "number"
+ },
+ "confidence_score_rating": {
+ "type": "string"
+ },
+ "confidence_score_vector": {
+ "type": "string"
+ },
+ "detected": {
+ "type": "string"
+ },
+ "dga": {
+ },
+ "domain": {
+ "type": "string"
+ },
+ "email": {
+ "type": "string"
+ },
+ "expiration": {
+ "type": "string"
+ },
+ "extended": {
+ "properties": {
+ "ais_consent": {
+ "type": "string"
+ },
+ "cyberint_guid": {
+ "type": "string"
+ },
+ "no_whitelist": {
+ "type": "string"
+ },
+ "notes": {
+ "type": "string"
+ },
+ "protocol": {
+ "type": "string"
+ },
+ "url_hash": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "hash": {
+ "type": "string"
+ },
+ "hash_type": {
+ "type": "string"
+ },
+ "host": {
+ "type": "string"
+ },
+ "id": {
+ "type": "string"
+ },
+ "imported": {
+ "type": "string"
+ },
+ "ip": {
+ "type": "string"
+ },
+ "profile": {
+ "type": "string"
+ },
+ "property": {
+ "type": "string"
+ },
+ "received": {
+ "type": "string"
+ },
+ "risk_score": {
+ "type": "number"
+ },
+ "risk_score_rating": {
+ "type": "string"
+ },
+ "risk_score_vector": {
+ "type": "string"
+ },
+ "threat_level": {
+ "type": "integer"
+ },
+ "threat_score": {
+ "type": "number"
+ },
+ "threat_score_rating": {
+ "type": "string"
+ },
+ "threat_score_vector": {
+ "type": "string"
+ },
+ "tld": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ },
+ "up": {
+ },
+ "url": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "id"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ }
+ }
+ }
+ },
+ "outputs": {
+ }
+ },
+ "parameters": {
+ }
+ },
+ "name": "[parameters('PlaybookName')]",
+ "type": "Microsoft.Logic/workflows",
+ "location": "[resourceGroup().location]",
+ "tags": {
+ "hidden-SentinelTemplateName": "Infoblox-Import-Emails-Weekly",
+ "hidden-SentinelTemplateVersion": "1.0"
+ },
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "apiVersion": "2017-07-01",
+ "dependsOn": [
+ ]
+ }
+ ]
+}
diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hashes-Weekly/azuredeploy.json b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hashes-Weekly/azuredeploy.json
new file mode 100644
index 00000000000..709395cec33
--- /dev/null
+++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hashes-Weekly/azuredeploy.json
@@ -0,0 +1,517 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "1.0.0.0",
+ "metadata": {
+ "title": "Infoblox Import Hashes Weekly",
+ "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected hashes on a scheduled weekly basis.",
+ "prerequisites": [
+ "Infoblox TIDE API key."
+ ],
+ "postDeployment": [
+ "Authorize connections."
+ ],
+ "prerequisitesDeployTemplateFile": "",
+ "lastUpdateTime": "2023-08-07T00:00:00.000Z",
+ "entities": [
+ ],
+ "tags": [
+ ],
+ "support": {
+ "tier": "community",
+ "armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator"
+ },
+ "author": {
+ "name": "Infoblox"
+ }
+ },
+ "parameters": {
+ "PlaybookName": {
+ "defaultValue": "Infoblox-Import-Hashes-Weekly",
+ "type": "string"
+ },
+ "AD Application Secret": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for AD Application Secret"
+ }
+ },
+ "Client ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Client ID"
+ }
+ },
+ "TIDE API Key": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for TIDE API Key"
+ }
+ },
+ "Tenant ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Tenant ID"
+ }
+ }
+ },
+ "variables": {
+ },
+ "resources": [
+ {
+ "properties": {
+ "provisioningState": "Succeeded",
+ "state": "Disabled",
+ "definition": {
+ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "AD Application Secret": {
+ "defaultValue": "[parameters('AD Application Secret')]",
+ "type": "string"
+ },
+ "Client ID": {
+ "defaultValue": "[parameters('Client ID')]",
+ "type": "string"
+ },
+ "TIDE API Key": {
+ "defaultValue": "[parameters('TIDE API Key')]",
+ "type": "string"
+ },
+ "Tenant ID": {
+ "defaultValue": "[parameters('Tenant ID')]",
+ "type": "string"
+ }
+ },
+ "triggers": {
+ "Recurrence": {
+ "recurrence": {
+ "frequency": "Week",
+ "interval": 1
+ },
+ "evaluatedRecurrence": {
+ "frequency": "Week",
+ "interval": 1
+ },
+ "type": "Recurrence"
+ }
+ },
+ "actions": {
+ "For_Each_Indicator_(Threat)": {
+ "foreach": "@body('Parse_JSON')?['threat']",
+ "actions": {
+ "Switch": {
+ "runAfter": {
+ },
+ "cases": {
+ "EMAIL": {
+ "case": "EMAIL",
+ "actions": {
+ "Send_Emails_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}",
+ "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HASH": {
+ "case": "HASH",
+ "actions": {
+ "Send_Hashes_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "fileHashType": "@{toLower(items('For_Each_Indicator_(Threat)')?['hash_type'])}",
+ "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}",
+ "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HOST": {
+ "case": "HOST",
+ "actions": {
+ "Send_Hosts_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "IP": {
+ "case": "IP",
+ "actions": {
+ "Send_IPs_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "URL": {
+ "case": "URL",
+ "actions": {
+ "Send_URLs_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white",
+ "url": "@{items('For_Each_Indicator_(Threat)')?['url']}"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ }
+ },
+ "default": {
+ "actions": {
+ }
+ },
+ "expression": "@items('For_Each_Indicator_(Threat)')?['type']",
+ "type": "Switch"
+ }
+ },
+ "runAfter": {
+ "Parse_JSON": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "Get_TIDE_Data": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "headers": {
+ "Authorization": "Token @{parameters('TIDE API Key')}"
+ },
+ "method": "GET",
+ "queries": {
+ "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url",
+ "rlimit": "90000"
+ },
+ "uri": "https://csp.infoblox.com/tide/api/data/threats/hash/weekly"
+ }
+ },
+ "Parse_JSON": {
+ "runAfter": {
+ "Get_TIDE_Data": [
+ "Succeeded"
+ ]
+ },
+ "type": "ParseJson",
+ "inputs": {
+ "content": "@body('Get_TIDE_Data')",
+ "schema": {
+ "properties": {
+ "record_count": {
+ "type": "integer"
+ },
+ "threat": {
+ "items": {
+ "properties": {
+ "batch_id": {
+ "type": "string"
+ },
+ "class": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "integer"
+ },
+ "confidence_score": {
+ "type": "number"
+ },
+ "confidence_score_rating": {
+ "type": "string"
+ },
+ "confidence_score_vector": {
+ "type": "string"
+ },
+ "detected": {
+ "type": "string"
+ },
+ "dga": {
+ },
+ "domain": {
+ "type": "string"
+ },
+ "email": {
+ "type": "string"
+ },
+ "expiration": {
+ "type": "string"
+ },
+ "extended": {
+ "properties": {
+ "ais_consent": {
+ "type": "string"
+ },
+ "cyberint_guid": {
+ "type": "string"
+ },
+ "no_whitelist": {
+ "type": "string"
+ },
+ "notes": {
+ "type": "string"
+ },
+ "protocol": {
+ "type": "string"
+ },
+ "url_hash": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "hash": {
+ "type": "string"
+ },
+ "hash_type": {
+ "type": "string"
+ },
+ "host": {
+ "type": "string"
+ },
+ "id": {
+ "type": "string"
+ },
+ "imported": {
+ "type": "string"
+ },
+ "ip": {
+ "type": "string"
+ },
+ "profile": {
+ "type": "string"
+ },
+ "property": {
+ "type": "string"
+ },
+ "received": {
+ "type": "string"
+ },
+ "risk_score": {
+ "type": "number"
+ },
+ "risk_score_rating": {
+ "type": "string"
+ },
+ "risk_score_vector": {
+ "type": "string"
+ },
+ "threat_level": {
+ "type": "integer"
+ },
+ "threat_score": {
+ "type": "number"
+ },
+ "threat_score_rating": {
+ "type": "string"
+ },
+ "threat_score_vector": {
+ "type": "string"
+ },
+ "tld": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ },
+ "up": {
+ },
+ "url": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "id"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ }
+ }
+ }
+ },
+ "outputs": {
+ }
+ },
+ "parameters": {
+ }
+ },
+ "name": "[parameters('PlaybookName')]",
+ "type": "Microsoft.Logic/workflows",
+ "location": "[resourceGroup().location]",
+ "tags": {
+ "hidden-SentinelTemplateName": "Infoblox-Import-Hashes-Weekly",
+ "hidden-SentinelTemplateVersion": "1.0"
+ },
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "apiVersion": "2017-07-01",
+ "dependsOn": [
+ ]
+ }
+ ]
+}
diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Daily-LookalikeDomains/azuredeploy.json b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Daily-LookalikeDomains/azuredeploy.json
new file mode 100644
index 00000000000..04f8a6a35bb
--- /dev/null
+++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Daily-LookalikeDomains/azuredeploy.json
@@ -0,0 +1,518 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "1.0.0.0",
+ "metadata": {
+ "title": "Infoblox Import Hosts Daily Lookalike Domains",
+ "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected Lookalike domains on a scheduled daily basis.",
+ "prerequisites": [
+ "Infoblox TIDE API key."
+ ],
+ "postDeployment": [
+ "Authorize connections."
+ ],
+ "prerequisitesDeployTemplateFile": "",
+ "lastUpdateTime": "2023-08-07T00:00:00.000Z",
+ "entities": [
+ ],
+ "tags": [
+ ],
+ "support": {
+ "tier": "community",
+ "armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator"
+ },
+ "author": {
+ "name": "Infoblox"
+ }
+ },
+ "parameters": {
+ "PlaybookName": {
+ "defaultValue": "Infoblox-Import-Hosts-Daily-LookalikeDomains",
+ "type": "string"
+ },
+ "AD Application Secret": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for AD Application Secret"
+ }
+ },
+ "Client ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Client ID"
+ }
+ },
+ "TIDE API Key": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for TIDE API Key"
+ }
+ },
+ "Tenant ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Tenant ID"
+ }
+ }
+ },
+ "variables": {
+ },
+ "resources": [
+ {
+ "properties": {
+ "provisioningState": "Succeeded",
+ "state": "Disabled",
+ "definition": {
+ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "AD Application Secret": {
+ "defaultValue": "[parameters('AD Application Secret')]",
+ "type": "string"
+ },
+ "Client ID": {
+ "defaultValue": "[parameters('Client ID')]",
+ "type": "string"
+ },
+ "TIDE API Key": {
+ "defaultValue": "[parameters('TIDE API Key')]",
+ "type": "string"
+ },
+ "Tenant ID": {
+ "defaultValue": "[parameters('Tenant ID')]",
+ "type": "string"
+ }
+ },
+ "triggers": {
+ "Recurrence": {
+ "recurrence": {
+ "frequency": "Day",
+ "interval": 1
+ },
+ "evaluatedRecurrence": {
+ "frequency": "Day",
+ "interval": 1
+ },
+ "type": "Recurrence"
+ }
+ },
+ "actions": {
+ "For_Each_Indicator_(Threat)": {
+ "foreach": "@body('Parse_JSON')?['threat']",
+ "actions": {
+ "Switch": {
+ "runAfter": {
+ },
+ "cases": {
+ "EMAIL": {
+ "case": "EMAIL",
+ "actions": {
+ "Send_Emails_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}",
+ "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HASH": {
+ "case": "HASH",
+ "actions": {
+ "Send_Hashes_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}",
+ "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}",
+ "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HOST": {
+ "case": "HOST",
+ "actions": {
+ "Send_Hosts_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "IP": {
+ "case": "IP",
+ "actions": {
+ "Send_IPs_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "URL": {
+ "case": "URL",
+ "actions": {
+ "Send_URLs_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white",
+ "url": "@{items('For_Each_Indicator_(Threat)')?['url']}"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ }
+ },
+ "default": {
+ "actions": {
+ }
+ },
+ "expression": "@items('For_Each_Indicator_(Threat)')?['type']",
+ "type": "Switch"
+ }
+ },
+ "runAfter": {
+ "Parse_JSON": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "Get_TIDE_Data": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "headers": {
+ "Authorization": "Token @{parameters('TIDE API Key')}"
+ },
+ "method": "GET",
+ "queries": {
+ "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url",
+ "property": "Policy_LookalikeDomains",
+ "rlimit": "90000"
+ },
+ "uri": "https://csp.infoblox.com/tide/api/data/threats/host/daily"
+ }
+ },
+ "Parse_JSON": {
+ "runAfter": {
+ "Get_TIDE_Data": [
+ "Succeeded"
+ ]
+ },
+ "type": "ParseJson",
+ "inputs": {
+ "content": "@body('Get_TIDE_Data')",
+ "schema": {
+ "properties": {
+ "record_count": {
+ "type": "integer"
+ },
+ "threat": {
+ "items": {
+ "properties": {
+ "batch_id": {
+ "type": "string"
+ },
+ "class": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "integer"
+ },
+ "confidence_score": {
+ "type": "number"
+ },
+ "confidence_score_rating": {
+ "type": "string"
+ },
+ "confidence_score_vector": {
+ "type": "string"
+ },
+ "detected": {
+ "type": "string"
+ },
+ "dga": {
+ },
+ "domain": {
+ "type": "string"
+ },
+ "email": {
+ "type": "string"
+ },
+ "expiration": {
+ "type": "string"
+ },
+ "extended": {
+ "properties": {
+ "ais_consent": {
+ "type": "string"
+ },
+ "cyberint_guid": {
+ "type": "string"
+ },
+ "no_whitelist": {
+ "type": "string"
+ },
+ "notes": {
+ "type": "string"
+ },
+ "protocol": {
+ "type": "string"
+ },
+ "url_hash": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "hash": {
+ "type": "string"
+ },
+ "hash_type": {
+ "type": "string"
+ },
+ "host": {
+ "type": "string"
+ },
+ "id": {
+ "type": "string"
+ },
+ "imported": {
+ "type": "string"
+ },
+ "ip": {
+ "type": "string"
+ },
+ "profile": {
+ "type": "string"
+ },
+ "property": {
+ "type": "string"
+ },
+ "received": {
+ "type": "string"
+ },
+ "risk_score": {
+ "type": "number"
+ },
+ "risk_score_rating": {
+ "type": "string"
+ },
+ "risk_score_vector": {
+ "type": "string"
+ },
+ "threat_level": {
+ "type": "integer"
+ },
+ "threat_score": {
+ "type": "number"
+ },
+ "threat_score_rating": {
+ "type": "string"
+ },
+ "threat_score_vector": {
+ "type": "string"
+ },
+ "tld": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ },
+ "up": {
+ },
+ "url": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "id"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ }
+ }
+ }
+ },
+ "outputs": {
+ }
+ },
+ "parameters": {
+ }
+ },
+ "name": "[parameters('PlaybookName')]",
+ "type": "Microsoft.Logic/workflows",
+ "location": "[resourceGroup().location]",
+ "tags": {
+ "hidden-SentinelTemplateName": "Infoblox-Import-Hosts-Daily-LookalikeDomains",
+ "hidden-SentinelTemplateVersion": "1.0"
+ },
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "apiVersion": "2017-07-01",
+ "dependsOn": [
+ ]
+ }
+ ]
+}
diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Daily-MalwareC2DGA/azuredeploy.json b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Daily-MalwareC2DGA/azuredeploy.json
new file mode 100644
index 00000000000..8d291e97d7a
--- /dev/null
+++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Daily-MalwareC2DGA/azuredeploy.json
@@ -0,0 +1,518 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "1.0.0.0",
+ "metadata": {
+ "title": "Infoblox Import Hosts Daily MalwareC2DGA",
+ "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected MalwareC2DGA domains on a scheduled daily basis.",
+ "prerequisites": [
+ "Infoblox TIDE API key."
+ ],
+ "postDeployment": [
+ "Authorize connections."
+ ],
+ "prerequisitesDeployTemplateFile": "",
+ "lastUpdateTime": "2023-08-07T00:00:00.000Z",
+ "entities": [
+ ],
+ "tags": [
+ ],
+ "support": {
+ "tier": "community",
+ "armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator"
+ },
+ "author": {
+ "name": "Infoblox"
+ }
+ },
+ "parameters": {
+ "PlaybookName": {
+ "defaultValue": "Infoblox-Import-Hosts-Daily-MalwareC2DGA",
+ "type": "string"
+ },
+ "AD Application Secret": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for AD Application Secret"
+ }
+ },
+ "Client ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Client ID"
+ }
+ },
+ "TIDE API Key": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for TIDE API Key"
+ }
+ },
+ "Tenant ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Tenant ID"
+ }
+ }
+ },
+ "variables": {
+ },
+ "resources": [
+ {
+ "properties": {
+ "provisioningState": "Succeeded",
+ "state": "Disabled",
+ "definition": {
+ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "AD Application Secret": {
+ "defaultValue": "[parameters('AD Application Secret')]",
+ "type": "string"
+ },
+ "Client ID": {
+ "defaultValue": "[parameters('Client ID')]",
+ "type": "string"
+ },
+ "TIDE API Key": {
+ "defaultValue": "[parameters('TIDE API Key')]",
+ "type": "string"
+ },
+ "Tenant ID": {
+ "defaultValue": "[parameters('Tenant ID')]",
+ "type": "string"
+ }
+ },
+ "triggers": {
+ "Recurrence": {
+ "recurrence": {
+ "frequency": "Day",
+ "interval": 1
+ },
+ "evaluatedRecurrence": {
+ "frequency": "Day",
+ "interval": 1
+ },
+ "type": "Recurrence"
+ }
+ },
+ "actions": {
+ "For_Each_Indicator_(Threat)": {
+ "foreach": "@body('Parse_JSON')?['threat']",
+ "actions": {
+ "Switch": {
+ "runAfter": {
+ },
+ "cases": {
+ "EMAIL": {
+ "case": "EMAIL",
+ "actions": {
+ "Send_Emails_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}",
+ "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HASH": {
+ "case": "HASH",
+ "actions": {
+ "Send_Hashes_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}",
+ "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}",
+ "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HOST": {
+ "case": "HOST",
+ "actions": {
+ "Send_Hosts_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "IP": {
+ "case": "IP",
+ "actions": {
+ "Send_IPs_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "URL": {
+ "case": "URL",
+ "actions": {
+ "Send_URLs_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white",
+ "url": "@{items('For_Each_Indicator_(Threat)')?['url']}"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ }
+ },
+ "default": {
+ "actions": {
+ }
+ },
+ "expression": "@items('For_Each_Indicator_(Threat)')?['type']",
+ "type": "Switch"
+ }
+ },
+ "runAfter": {
+ "Parse_JSON": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "Get_TIDE_Data": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "headers": {
+ "Authorization": "Token @{parameters('TIDE API Key')}"
+ },
+ "method": "GET",
+ "queries": {
+ "class": "MalwareC2DGA",
+ "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url",
+ "rlimit": "90000"
+ },
+ "uri": "https://csp.infoblox.com/tide/api/data/threats/host/daily"
+ }
+ },
+ "Parse_JSON": {
+ "runAfter": {
+ "Get_TIDE_Data": [
+ "Succeeded"
+ ]
+ },
+ "type": "ParseJson",
+ "inputs": {
+ "content": "@body('Get_TIDE_Data')",
+ "schema": {
+ "properties": {
+ "record_count": {
+ "type": "integer"
+ },
+ "threat": {
+ "items": {
+ "properties": {
+ "batch_id": {
+ "type": "string"
+ },
+ "class": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "integer"
+ },
+ "confidence_score": {
+ "type": "number"
+ },
+ "confidence_score_rating": {
+ "type": "string"
+ },
+ "confidence_score_vector": {
+ "type": "string"
+ },
+ "detected": {
+ "type": "string"
+ },
+ "dga": {
+ },
+ "domain": {
+ "type": "string"
+ },
+ "email": {
+ "type": "string"
+ },
+ "expiration": {
+ "type": "string"
+ },
+ "extended": {
+ "properties": {
+ "ais_consent": {
+ "type": "string"
+ },
+ "cyberint_guid": {
+ "type": "string"
+ },
+ "no_whitelist": {
+ "type": "string"
+ },
+ "notes": {
+ "type": "string"
+ },
+ "protocol": {
+ "type": "string"
+ },
+ "url_hash": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "hash": {
+ "type": "string"
+ },
+ "hash_type": {
+ "type": "string"
+ },
+ "host": {
+ "type": "string"
+ },
+ "id": {
+ "type": "string"
+ },
+ "imported": {
+ "type": "string"
+ },
+ "ip": {
+ "type": "string"
+ },
+ "profile": {
+ "type": "string"
+ },
+ "property": {
+ "type": "string"
+ },
+ "received": {
+ "type": "string"
+ },
+ "risk_score": {
+ "type": "number"
+ },
+ "risk_score_rating": {
+ "type": "string"
+ },
+ "risk_score_vector": {
+ "type": "string"
+ },
+ "threat_level": {
+ "type": "integer"
+ },
+ "threat_score": {
+ "type": "number"
+ },
+ "threat_score_rating": {
+ "type": "string"
+ },
+ "threat_score_vector": {
+ "type": "string"
+ },
+ "tld": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ },
+ "up": {
+ },
+ "url": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "id"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ }
+ }
+ }
+ },
+ "outputs": {
+ }
+ },
+ "parameters": {
+ }
+ },
+ "name": "[parameters('PlaybookName')]",
+ "type": "Microsoft.Logic/workflows",
+ "location": "[resourceGroup().location]",
+ "tags": {
+ "hidden-SentinelTemplateName": "Infoblox-Import-Hosts-Daily-MalwareC2DGA",
+ "hidden-SentinelTemplateVersion": "1.0"
+ },
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "apiVersion": "2017-07-01",
+ "dependsOn": [
+ ]
+ }
+ ]
+}
diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Daily-Phishing/azuredeploy.json b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Daily-Phishing/azuredeploy.json
new file mode 100644
index 00000000000..9967fff694c
--- /dev/null
+++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Daily-Phishing/azuredeploy.json
@@ -0,0 +1,518 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "1.0.0.0",
+ "metadata": {
+ "title": "Infoblox Import Hosts Daily Phishing",
+ "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected Phishing domains on a scheduled daily basis.",
+ "prerequisites": [
+ "Infoblox TIDE API key."
+ ],
+ "postDeployment": [
+ "Authorize connections."
+ ],
+ "prerequisitesDeployTemplateFile": "",
+ "lastUpdateTime": "2023-08-07T00:00:00.000Z",
+ "entities": [
+ ],
+ "tags": [
+ ],
+ "support": {
+ "tier": "community",
+ "armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator"
+ },
+ "author": {
+ "name": "Infoblox"
+ }
+ },
+ "parameters": {
+ "PlaybookName": {
+ "defaultValue": "Infoblox-Import-Hosts-Daily-Phishing",
+ "type": "string"
+ },
+ "AD Application Secret": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for AD Application Secret"
+ }
+ },
+ "Client ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Client ID"
+ }
+ },
+ "TIDE API Key": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for TIDE API Key"
+ }
+ },
+ "Tenant ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Tenant ID"
+ }
+ }
+ },
+ "variables": {
+ },
+ "resources": [
+ {
+ "properties": {
+ "provisioningState": "Succeeded",
+ "state": "Disabled",
+ "definition": {
+ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "AD Application Secret": {
+ "defaultValue": "[parameters('AD Application Secret')]",
+ "type": "string"
+ },
+ "Client ID": {
+ "defaultValue": "[parameters('Client ID')]",
+ "type": "string"
+ },
+ "TIDE API Key": {
+ "defaultValue": "[parameters('TIDE API Key')]",
+ "type": "string"
+ },
+ "Tenant ID": {
+ "defaultValue": "[parameters('Tenant ID')]",
+ "type": "string"
+ }
+ },
+ "triggers": {
+ "Recurrence": {
+ "recurrence": {
+ "frequency": "Day",
+ "interval": 1
+ },
+ "evaluatedRecurrence": {
+ "frequency": "Day",
+ "interval": 1
+ },
+ "type": "Recurrence"
+ }
+ },
+ "actions": {
+ "For_Each_Indicator_(Threat)": {
+ "foreach": "@body('Parse_JSON')?['threat']",
+ "actions": {
+ "Switch": {
+ "runAfter": {
+ },
+ "cases": {
+ "EMAIL": {
+ "case": "EMAIL",
+ "actions": {
+ "Send_Emails_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}",
+ "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HASH": {
+ "case": "HASH",
+ "actions": {
+ "Send_Hashes_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}",
+ "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}",
+ "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HOST": {
+ "case": "HOST",
+ "actions": {
+ "Send_Hosts_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "IP": {
+ "case": "IP",
+ "actions": {
+ "Send_IPs_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "URL": {
+ "case": "URL",
+ "actions": {
+ "Send_URLs_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white",
+ "url": "@{items('For_Each_Indicator_(Threat)')?['url']}"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ }
+ },
+ "default": {
+ "actions": {
+ }
+ },
+ "expression": "@items('For_Each_Indicator_(Threat)')?['type']",
+ "type": "Switch"
+ }
+ },
+ "runAfter": {
+ "Parse_JSON": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "Get_TIDE_Data": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "headers": {
+ "Authorization": "Token @{parameters('TIDE API Key')}"
+ },
+ "method": "GET",
+ "queries": {
+ "class": "Phishing",
+ "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url",
+ "rlimit": "90000"
+ },
+ "uri": "https://csp.infoblox.com/tide/api/data/threats/host/daily"
+ }
+ },
+ "Parse_JSON": {
+ "runAfter": {
+ "Get_TIDE_Data": [
+ "Succeeded"
+ ]
+ },
+ "type": "ParseJson",
+ "inputs": {
+ "content": "@body('Get_TIDE_Data')",
+ "schema": {
+ "properties": {
+ "record_count": {
+ "type": "integer"
+ },
+ "threat": {
+ "items": {
+ "properties": {
+ "batch_id": {
+ "type": "string"
+ },
+ "class": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "integer"
+ },
+ "confidence_score": {
+ "type": "number"
+ },
+ "confidence_score_rating": {
+ "type": "string"
+ },
+ "confidence_score_vector": {
+ "type": "string"
+ },
+ "detected": {
+ "type": "string"
+ },
+ "dga": {
+ },
+ "domain": {
+ "type": "string"
+ },
+ "email": {
+ "type": "string"
+ },
+ "expiration": {
+ "type": "string"
+ },
+ "extended": {
+ "properties": {
+ "ais_consent": {
+ "type": "string"
+ },
+ "cyberint_guid": {
+ "type": "string"
+ },
+ "no_whitelist": {
+ "type": "string"
+ },
+ "notes": {
+ "type": "string"
+ },
+ "protocol": {
+ "type": "string"
+ },
+ "url_hash": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "hash": {
+ "type": "string"
+ },
+ "hash_type": {
+ "type": "string"
+ },
+ "host": {
+ "type": "string"
+ },
+ "id": {
+ "type": "string"
+ },
+ "imported": {
+ "type": "string"
+ },
+ "ip": {
+ "type": "string"
+ },
+ "profile": {
+ "type": "string"
+ },
+ "property": {
+ "type": "string"
+ },
+ "received": {
+ "type": "string"
+ },
+ "risk_score": {
+ "type": "number"
+ },
+ "risk_score_rating": {
+ "type": "string"
+ },
+ "risk_score_vector": {
+ "type": "string"
+ },
+ "threat_level": {
+ "type": "integer"
+ },
+ "threat_score": {
+ "type": "number"
+ },
+ "threat_score_rating": {
+ "type": "string"
+ },
+ "threat_score_vector": {
+ "type": "string"
+ },
+ "tld": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ },
+ "up": {
+ },
+ "url": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "id"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ }
+ }
+ }
+ },
+ "outputs": {
+ }
+ },
+ "parameters": {
+ }
+ },
+ "name": "[parameters('PlaybookName')]",
+ "type": "Microsoft.Logic/workflows",
+ "location": "[resourceGroup().location]",
+ "tags": {
+ "hidden-SentinelTemplateName": "Infoblox-Import-Hosts-Daily-Phishing",
+ "hidden-SentinelTemplateVersion": "1.0"
+ },
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "apiVersion": "2017-07-01",
+ "dependsOn": [
+ ]
+ }
+ ]
+}
diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Hourly/azuredeploy.json b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Hourly/azuredeploy.json
new file mode 100644
index 00000000000..2f1152a29bc
--- /dev/null
+++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Hourly/azuredeploy.json
@@ -0,0 +1,517 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "1.0.0.0",
+ "metadata": {
+ "title": "Infoblox Import Hosts Hourly",
+ "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports all newly detected hosts on a scheduled hourly basis.",
+ "prerequisites": [
+ "Infoblox TIDE API key."
+ ],
+ "postDeployment": [
+ "Authorize connections."
+ ],
+ "prerequisitesDeployTemplateFile": "",
+ "lastUpdateTime": "2023-08-07T00:00:00.000Z",
+ "entities": [
+ ],
+ "tags": [
+ ],
+ "support": {
+ "tier": "community",
+ "armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator"
+ },
+ "author": {
+ "name": "Infoblox"
+ }
+ },
+ "parameters": {
+ "PlaybookName": {
+ "defaultValue": "Infoblox-Import-Hosts-Hourly",
+ "type": "string"
+ },
+ "AD Application Secret": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for AD Application Secret"
+ }
+ },
+ "Client ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Client ID"
+ }
+ },
+ "TIDE API Key": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for TIDE API Key"
+ }
+ },
+ "Tenant ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Tenant ID"
+ }
+ }
+ },
+ "variables": {
+ },
+ "resources": [
+ {
+ "properties": {
+ "provisioningState": "Succeeded",
+ "state": "Disabled",
+ "definition": {
+ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "AD Application Secret": {
+ "defaultValue": "[parameters('AD Application Secret')]",
+ "type": "string"
+ },
+ "Client ID": {
+ "defaultValue": "[parameters('Client ID')]",
+ "type": "string"
+ },
+ "TIDE API Key": {
+ "defaultValue": "[parameters('TIDE API Key')]",
+ "type": "string"
+ },
+ "Tenant ID": {
+ "defaultValue": "[parameters('Tenant ID')]",
+ "type": "string"
+ }
+ },
+ "triggers": {
+ "Recurrence": {
+ "recurrence": {
+ "frequency": "Hour",
+ "interval": 1
+ },
+ "evaluatedRecurrence": {
+ "frequency": "Hour",
+ "interval": 1
+ },
+ "type": "Recurrence"
+ }
+ },
+ "actions": {
+ "For_Each_Indicator_(Threat)": {
+ "foreach": "@body('Parse_JSON')?['threat']",
+ "actions": {
+ "Switch": {
+ "runAfter": {
+ },
+ "cases": {
+ "EMAIL": {
+ "case": "EMAIL",
+ "actions": {
+ "Send_Emails_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}",
+ "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HASH": {
+ "case": "HASH",
+ "actions": {
+ "Send_Hashes_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}",
+ "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}",
+ "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HOST": {
+ "case": "HOST",
+ "actions": {
+ "Send_Hosts_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "IP": {
+ "case": "IP",
+ "actions": {
+ "Send_IPs_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "URL": {
+ "case": "URL",
+ "actions": {
+ "Send_URLs_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white",
+ "url": "@{items('For_Each_Indicator_(Threat)')?['url']}"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ }
+ },
+ "default": {
+ "actions": {
+ }
+ },
+ "expression": "@items('For_Each_Indicator_(Threat)')?['type']",
+ "type": "Switch"
+ }
+ },
+ "runAfter": {
+ "Parse_JSON": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "Get_TIDE_Data": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "headers": {
+ "Authorization": "Token @{parameters('TIDE API Key')}"
+ },
+ "method": "GET",
+ "queries": {
+ "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url",
+ "rlimit": "90000"
+ },
+ "uri": "https://csp.infoblox.com/tide/api/data/threats/host/hourly"
+ }
+ },
+ "Parse_JSON": {
+ "runAfter": {
+ "Get_TIDE_Data": [
+ "Succeeded"
+ ]
+ },
+ "type": "ParseJson",
+ "inputs": {
+ "content": "@body('Get_TIDE_Data')",
+ "schema": {
+ "properties": {
+ "record_count": {
+ "type": "integer"
+ },
+ "threat": {
+ "items": {
+ "properties": {
+ "batch_id": {
+ "type": "string"
+ },
+ "class": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "integer"
+ },
+ "confidence_score": {
+ "type": "number"
+ },
+ "confidence_score_rating": {
+ "type": "string"
+ },
+ "confidence_score_vector": {
+ "type": "string"
+ },
+ "detected": {
+ "type": "string"
+ },
+ "dga": {
+ },
+ "domain": {
+ "type": "string"
+ },
+ "email": {
+ "type": "string"
+ },
+ "expiration": {
+ "type": "string"
+ },
+ "extended": {
+ "properties": {
+ "ais_consent": {
+ "type": "string"
+ },
+ "cyberint_guid": {
+ "type": "string"
+ },
+ "no_whitelist": {
+ "type": "string"
+ },
+ "notes": {
+ "type": "string"
+ },
+ "protocol": {
+ "type": "string"
+ },
+ "url_hash": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "hash": {
+ "type": "string"
+ },
+ "hash_type": {
+ "type": "string"
+ },
+ "host": {
+ "type": "string"
+ },
+ "id": {
+ "type": "string"
+ },
+ "imported": {
+ "type": "string"
+ },
+ "ip": {
+ "type": "string"
+ },
+ "profile": {
+ "type": "string"
+ },
+ "property": {
+ "type": "string"
+ },
+ "received": {
+ "type": "string"
+ },
+ "risk_score": {
+ "type": "number"
+ },
+ "risk_score_rating": {
+ "type": "string"
+ },
+ "risk_score_vector": {
+ "type": "string"
+ },
+ "threat_level": {
+ "type": "integer"
+ },
+ "threat_score": {
+ "type": "number"
+ },
+ "threat_score_rating": {
+ "type": "string"
+ },
+ "threat_score_vector": {
+ "type": "string"
+ },
+ "tld": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ },
+ "up": {
+ },
+ "url": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "id"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ }
+ }
+ }
+ },
+ "outputs": {
+ }
+ },
+ "parameters": {
+ }
+ },
+ "name": "[parameters('PlaybookName')]",
+ "type": "Microsoft.Logic/workflows",
+ "location": "[resourceGroup().location]",
+ "tags": {
+ "hidden-SentinelTemplateName": "Infoblox-Import-Hosts-Hourly",
+ "hidden-SentinelTemplateVersion": "1.0"
+ },
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "apiVersion": "2017-07-01",
+ "dependsOn": [
+ ]
+ }
+ ]
+}
diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-IPs-Hourly/azuredeploy.json b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-IPs-Hourly/azuredeploy.json
new file mode 100644
index 00000000000..e163c5bb1f2
--- /dev/null
+++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-IPs-Hourly/azuredeploy.json
@@ -0,0 +1,517 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "1.0.0.0",
+ "metadata": {
+ "title": "Infoblox Import IPs Hourly",
+ "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports all newly detected IPs on a scheduled hourly basis.",
+ "prerequisites": [
+ "Infoblox TIDE API key."
+ ],
+ "postDeployment": [
+ "Authorize connections."
+ ],
+ "prerequisitesDeployTemplateFile": "",
+ "lastUpdateTime": "2023-08-07T00:00:00.000Z",
+ "entities": [
+ ],
+ "tags": [
+ ],
+ "support": {
+ "tier": "community",
+ "armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator"
+ },
+ "author": {
+ "name": "Infoblox"
+ }
+ },
+ "parameters": {
+ "PlaybookName": {
+ "defaultValue": "Infoblox-Import-IPs-Hourly",
+ "type": "string"
+ },
+ "AD Application Secret": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for AD Application Secret"
+ }
+ },
+ "Client ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Client ID"
+ }
+ },
+ "TIDE API Key": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for TIDE API Key"
+ }
+ },
+ "Tenant ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Tenant ID"
+ }
+ }
+ },
+ "variables": {
+ },
+ "resources": [
+ {
+ "properties": {
+ "provisioningState": "Succeeded",
+ "state": "Disabled",
+ "definition": {
+ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "AD Application Secret": {
+ "defaultValue": "[parameters('AD Application Secret')]",
+ "type": "string"
+ },
+ "Client ID": {
+ "defaultValue": "[parameters('Client ID')]",
+ "type": "string"
+ },
+ "TIDE API Key": {
+ "defaultValue": "[parameters('TIDE API Key')]",
+ "type": "string"
+ },
+ "Tenant ID": {
+ "defaultValue": "[parameters('Tenant ID')]",
+ "type": "string"
+ }
+ },
+ "triggers": {
+ "Recurrence": {
+ "recurrence": {
+ "frequency": "Hour",
+ "interval": 1
+ },
+ "evaluatedRecurrence": {
+ "frequency": "Hour",
+ "interval": 1
+ },
+ "type": "Recurrence"
+ }
+ },
+ "actions": {
+ "For_Each_Indicator_(Threat)": {
+ "foreach": "@body('Parse_JSON')?['threat']",
+ "actions": {
+ "Switch": {
+ "runAfter": {
+ },
+ "cases": {
+ "EMAIL": {
+ "case": "EMAIL",
+ "actions": {
+ "Send_Emails_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}",
+ "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HASH": {
+ "case": "HASH",
+ "actions": {
+ "Send_Hashes_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}",
+ "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}",
+ "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HOST": {
+ "case": "HOST",
+ "actions": {
+ "Send_Hosts_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "IP": {
+ "case": "IP",
+ "actions": {
+ "Send_IPs_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "URL": {
+ "case": "URL",
+ "actions": {
+ "Send_URLs_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white",
+ "url": "@{items('For_Each_Indicator_(Threat)')?['url']}"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ }
+ },
+ "default": {
+ "actions": {
+ }
+ },
+ "expression": "@items('For_Each_Indicator_(Threat)')?['type']",
+ "type": "Switch"
+ }
+ },
+ "runAfter": {
+ "Parse_JSON": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "Get_TIDE_Data": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "headers": {
+ "Authorization": "Token @{parameters('TIDE API Key')}"
+ },
+ "method": "GET",
+ "queries": {
+ "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url",
+ "rlimit": "90000"
+ },
+ "uri": "https://csp.infoblox.com/tide/api/data/threats/ip/hourly"
+ }
+ },
+ "Parse_JSON": {
+ "runAfter": {
+ "Get_TIDE_Data": [
+ "Succeeded"
+ ]
+ },
+ "type": "ParseJson",
+ "inputs": {
+ "content": "@body('Get_TIDE_Data')",
+ "schema": {
+ "properties": {
+ "record_count": {
+ "type": "integer"
+ },
+ "threat": {
+ "items": {
+ "properties": {
+ "batch_id": {
+ "type": "string"
+ },
+ "class": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "integer"
+ },
+ "confidence_score": {
+ "type": "number"
+ },
+ "confidence_score_rating": {
+ "type": "string"
+ },
+ "confidence_score_vector": {
+ "type": "string"
+ },
+ "detected": {
+ "type": "string"
+ },
+ "dga": {
+ },
+ "domain": {
+ "type": "string"
+ },
+ "email": {
+ "type": "string"
+ },
+ "expiration": {
+ "type": "string"
+ },
+ "extended": {
+ "properties": {
+ "ais_consent": {
+ "type": "string"
+ },
+ "cyberint_guid": {
+ "type": "string"
+ },
+ "no_whitelist": {
+ "type": "string"
+ },
+ "notes": {
+ "type": "string"
+ },
+ "protocol": {
+ "type": "string"
+ },
+ "url_hash": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "hash": {
+ "type": "string"
+ },
+ "hash_type": {
+ "type": "string"
+ },
+ "host": {
+ "type": "string"
+ },
+ "id": {
+ "type": "string"
+ },
+ "imported": {
+ "type": "string"
+ },
+ "ip": {
+ "type": "string"
+ },
+ "profile": {
+ "type": "string"
+ },
+ "property": {
+ "type": "string"
+ },
+ "received": {
+ "type": "string"
+ },
+ "risk_score": {
+ "type": "number"
+ },
+ "risk_score_rating": {
+ "type": "string"
+ },
+ "risk_score_vector": {
+ "type": "string"
+ },
+ "threat_level": {
+ "type": "integer"
+ },
+ "threat_score": {
+ "type": "number"
+ },
+ "threat_score_rating": {
+ "type": "string"
+ },
+ "threat_score_vector": {
+ "type": "string"
+ },
+ "tld": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ },
+ "up": {
+ },
+ "url": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "id"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ }
+ }
+ }
+ },
+ "outputs": {
+ }
+ },
+ "parameters": {
+ }
+ },
+ "name": "[parameters('PlaybookName')]",
+ "type": "Microsoft.Logic/workflows",
+ "location": "[resourceGroup().location]",
+ "tags": {
+ "hidden-SentinelTemplateName": "Infoblox-Import-IPs-Hourly",
+ "hidden-SentinelTemplateVersion": "1.0"
+ },
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "apiVersion": "2017-07-01",
+ "dependsOn": [
+ ]
+ }
+ ]
+}
diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-URLs-Hourly/azuredeploy.json b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-URLs-Hourly/azuredeploy.json
new file mode 100644
index 00000000000..641c0b62cb0
--- /dev/null
+++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-URLs-Hourly/azuredeploy.json
@@ -0,0 +1,517 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "1.0.0.0",
+ "metadata": {
+ "title": "Infoblox Import URLs Hourly",
+ "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports all newly detected URLs on a scheduled hourly basis.",
+ "prerequisites": [
+ "Infoblox TIDE API key."
+ ],
+ "postDeployment": [
+ "Authorize connections."
+ ],
+ "prerequisitesDeployTemplateFile": "",
+ "lastUpdateTime": "2023-08-07T00:00:00.000Z",
+ "entities": [
+ ],
+ "tags": [
+ ],
+ "support": {
+ "tier": "community",
+ "armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator"
+ },
+ "author": {
+ "name": "Infoblox"
+ }
+ },
+ "parameters": {
+ "PlaybookName": {
+ "defaultValue": "Infoblox-Import-URLs-Hourly",
+ "type": "string"
+ },
+ "AD Application Secret": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for AD Application Secret"
+ }
+ },
+ "Client ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Client ID"
+ }
+ },
+ "TIDE API Key": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for TIDE API Key"
+ }
+ },
+ "Tenant ID": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Tenant ID"
+ }
+ }
+ },
+ "variables": {
+ },
+ "resources": [
+ {
+ "properties": {
+ "provisioningState": "Succeeded",
+ "state": "Disabled",
+ "definition": {
+ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "AD Application Secret": {
+ "defaultValue": "[parameters('AD Application Secret')]",
+ "type": "string"
+ },
+ "Client ID": {
+ "defaultValue": "[parameters('Client ID')]",
+ "type": "string"
+ },
+ "TIDE API Key": {
+ "defaultValue": "[parameters('TIDE API Key')]",
+ "type": "string"
+ },
+ "Tenant ID": {
+ "defaultValue": "[parameters('Tenant ID')]",
+ "type": "string"
+ }
+ },
+ "triggers": {
+ "Recurrence": {
+ "recurrence": {
+ "frequency": "Hour",
+ "interval": 1
+ },
+ "evaluatedRecurrence": {
+ "frequency": "Hour",
+ "interval": 1
+ },
+ "type": "Recurrence"
+ }
+ },
+ "actions": {
+ "For_Each_Indicator_(Threat)": {
+ "foreach": "@body('Parse_JSON')?['threat']",
+ "actions": {
+ "Switch": {
+ "runAfter": {
+ },
+ "cases": {
+ "EMAIL": {
+ "case": "EMAIL",
+ "actions": {
+ "Send_Emails_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}",
+ "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HASH": {
+ "case": "HASH",
+ "actions": {
+ "Send_Hashes_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}",
+ "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}",
+ "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "HOST": {
+ "case": "HOST",
+ "actions": {
+ "Send_Hosts_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "IP": {
+ "case": "IP",
+ "actions": {
+ "Send_IPs_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ },
+ "URL": {
+ "case": "URL",
+ "actions": {
+ "Send_URLs_to_Sentinel": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "authentication": {
+ "audience": "https://graph.microsoft.com",
+ "clientId": "@parameters('Client ID')",
+ "secret": "@parameters('AD Application Secret')",
+ "tenant": "@parameters('Tenant ID')",
+ "type": "ActiveDirectoryOAuth"
+ },
+ "body": {
+ "action": "alert",
+ "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}",
+ "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']",
+ "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}",
+ "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']",
+ "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}",
+ "indicatorProvider": "Infoblox TIDE",
+ "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']",
+ "tags": [
+ "@{items('For_Each_Indicator_(Threat)')?['type']}",
+ "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}",
+ "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}",
+ "Property: @{items('For_Each_Indicator_(Threat)')?['property']}",
+ "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}"
+ ],
+ "targetProduct": "Azure Sentinel",
+ "threatType": "WatchList",
+ "tlpLevel": "white",
+ "url": "@{items('For_Each_Indicator_(Threat)')?['url']}"
+ },
+ "method": "POST",
+ "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
+ }
+ }
+ }
+ }
+ },
+ "default": {
+ "actions": {
+ }
+ },
+ "expression": "@items('For_Each_Indicator_(Threat)')?['type']",
+ "type": "Switch"
+ }
+ },
+ "runAfter": {
+ "Parse_JSON": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "Get_TIDE_Data": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "headers": {
+ "Authorization": "Token @{parameters('TIDE API Key')}"
+ },
+ "method": "GET",
+ "queries": {
+ "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url",
+ "rlimit": "90000"
+ },
+ "uri": "https://csp.infoblox.com/tide/api/data/threats/url/hourly"
+ }
+ },
+ "Parse_JSON": {
+ "runAfter": {
+ "Get_TIDE_Data": [
+ "Succeeded"
+ ]
+ },
+ "type": "ParseJson",
+ "inputs": {
+ "content": "@body('Get_TIDE_Data')",
+ "schema": {
+ "properties": {
+ "record_count": {
+ "type": "integer"
+ },
+ "threat": {
+ "items": {
+ "properties": {
+ "batch_id": {
+ "type": "string"
+ },
+ "class": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "integer"
+ },
+ "confidence_score": {
+ "type": "number"
+ },
+ "confidence_score_rating": {
+ "type": "string"
+ },
+ "confidence_score_vector": {
+ "type": "string"
+ },
+ "detected": {
+ "type": "string"
+ },
+ "dga": {
+ },
+ "domain": {
+ "type": "string"
+ },
+ "email": {
+ "type": "string"
+ },
+ "expiration": {
+ "type": "string"
+ },
+ "extended": {
+ "properties": {
+ "ais_consent": {
+ "type": "string"
+ },
+ "cyberint_guid": {
+ "type": "string"
+ },
+ "no_whitelist": {
+ "type": "string"
+ },
+ "notes": {
+ "type": "string"
+ },
+ "protocol": {
+ "type": "string"
+ },
+ "url_hash": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "hash": {
+ "type": "string"
+ },
+ "hash_type": {
+ "type": "string"
+ },
+ "host": {
+ "type": "string"
+ },
+ "id": {
+ "type": "string"
+ },
+ "imported": {
+ "type": "string"
+ },
+ "ip": {
+ "type": "string"
+ },
+ "profile": {
+ "type": "string"
+ },
+ "property": {
+ "type": "string"
+ },
+ "received": {
+ "type": "string"
+ },
+ "risk_score": {
+ "type": "number"
+ },
+ "risk_score_rating": {
+ "type": "string"
+ },
+ "risk_score_vector": {
+ "type": "string"
+ },
+ "threat_level": {
+ "type": "integer"
+ },
+ "threat_score": {
+ "type": "number"
+ },
+ "threat_score_rating": {
+ "type": "string"
+ },
+ "threat_score_vector": {
+ "type": "string"
+ },
+ "tld": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ },
+ "up": {
+ },
+ "url": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "id"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ }
+ }
+ }
+ },
+ "outputs": {
+ }
+ },
+ "parameters": {
+ }
+ },
+ "name": "[parameters('PlaybookName')]",
+ "type": "Microsoft.Logic/workflows",
+ "location": "[resourceGroup().location]",
+ "tags": {
+ "hidden-SentinelTemplateName": "Infoblox-Import-URLs-Hourly",
+ "hidden-SentinelTemplateVersion": "1.0"
+ },
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "apiVersion": "2017-07-01",
+ "dependsOn": [
+ ]
+ }
+ ]
+}
diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Incident-Enrichment-Domains/azuredeploy.json b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Incident-Enrichment-Domains/azuredeploy.json
new file mode 100644
index 00000000000..95e828185da
--- /dev/null
+++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Incident-Enrichment-Domains/azuredeploy.json
@@ -0,0 +1,435 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "1.0.0.0",
+ "metadata": {
+ "title": "Infoblox Incident Enrichment Domains",
+ "description": "Leverages the Infoblox TIDE API to enrich Sentinel incidents with detailed TIDE data. This playbook can be configured to run automatically when an incident occurs (recommended) or run on demand.",
+ "prerequisites": [
+ "Infoblox TIDE API key."
+ ],
+ "postDeployment": [
+ "1. Grant playbook's Managed Identity **Microsoft Sentinel Responder** or greater to Resource Group.",
+ "2. Authorize connections."
+ ],
+ "prerequisitesDeployTemplateFile": "",
+ "lastUpdateTime": "2023-08-07T00:00:00.000Z",
+ "entities": [ "DnsResolution"
+ ],
+ "tags": [ "Enrichment"
+ ],
+ "support": {
+ "tier": "community",
+ "armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator"
+ },
+ "author": {
+ "name": "Infoblox"
+ }
+ },
+ "parameters": {
+ "PlaybookName": {
+ "defaultValue": "Infoblox-Incident-Enrichment-Domains",
+ "type": "string"
+ },
+ "TIDE API Key": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for TIDE API Key"
+ }
+ }
+ },
+ "variables": {
+ "MicrosoftSentinelConnectionName": "[concat('MicrosoftSentinel-', parameters('PlaybookName'))]"
+ },
+ "resources": [
+ {
+ "properties": {
+ "provisioningState": "Succeeded",
+ "state": "Disabled",
+ "definition": {
+ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "$connections": {
+ "defaultValue": {
+ },
+ "type": "Object"
+ },
+ "TIDE API Key": {
+ "defaultValue": "[parameters('TIDE API Key')]",
+ "type": "string"
+ }
+ },
+ "triggers": {
+ "Microsoft_Sentinel_incident": {
+ "type": "ApiConnectionWebhook",
+ "inputs": {
+ "body": {
+ "callback_url": "@{listCallbackUrl()}"
+ },
+ "host": {
+ "connection": {
+ "name": "@parameters('$connections')['azuresentinel']['connectionId']"
+ }
+ },
+ "path": "/incident-creation"
+ }
+ }
+ },
+ "actions": {
+ "Entities_-_Get_DNS": {
+ "runAfter": {
+ "Initialize_HTML": [
+ "Succeeded"
+ ]
+ },
+ "type": "ApiConnection",
+ "inputs": {
+ "body": "@triggerBody()?['object']?['properties']?['relatedEntities']",
+ "host": {
+ "connection": {
+ "name": "@parameters('$connections')['azuresentinel']['connectionId']"
+ }
+ },
+ "method": "post",
+ "path": "/entities/dnsresolution"
+ }
+ },
+ "For_each_DNS_Domain_Entity": {
+ "foreach": "@body('Entities_-_Get_DNS')?['Dnsresolutions']",
+ "actions": {
+ "For_each_Threat_IoC": {
+ "foreach": "@body('Parse_JSON')?['threat']",
+ "actions": {
+ "Enrich_Incident_with_TIDE_Data_if_it_exists": {
+ "actions": {
+ },
+ "runAfter": {
+ },
+ "else": {
+ "actions": {
+ "Add_comment_to_incident": {
+ "runAfter": {
+ "Set_HTML_Table_with_TIDE_Data": [
+ "Succeeded"
+ ]
+ },
+ "type": "ApiConnection",
+ "inputs": {
+ "body": {
+ "incidentArmId": "@triggerBody()?['object']?['id']",
+ "message": "\u003cp\u003eIoC - @{items('For_each_DNS_Domain_Entity')?['DomainName']} - @{items('For_each_Threat_IoC')?['type']} - @{items('For_each_Threat_IoC')?['class']}\u003cbr\u003e\n@{variables('html')}\u003c/p\u003e"
+ },
+ "host": {
+ "connection": {
+ "name": "@parameters('$connections')['azuresentinel']['connectionId']"
+ }
+ },
+ "method": "post",
+ "path": "/Incidents/Comment"
+ }
+ },
+ "Set_HTML_Table_with_TIDE_Data": {
+ "runAfter": {
+ },
+ "type": "SetVariable",
+ "inputs": {
+ "name": "html",
+ "value": "\u003cp style=\"height:0px\"\u003e\u003ctable\u003e\u003ctbody\u003e \n\u003ctr\u003e\u003ctd\u003eID\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['id']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eType\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['type']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eHost\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['host']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eDomain\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['domain']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eURL\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['url']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eIP\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['ip']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctd\u003eEmail\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['email']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eHash\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['hash']} @{items('For_each_Threat_IoC')?['hash_type']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eProfile\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['profile']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eProperty\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['property']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eThreat Level\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['threat_level']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eConfidence\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['confidence']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eDetected\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['detected']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eReceived\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['received']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eImported\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['imported']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eExpiration\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['expiration']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd \u003eDescription\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['extended']?['notes']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd \u003eOpen in CSP\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003ehttps://csp.infoblox.com/#/security_research/search/auto/@{items('For_each_Threat_IoC')?['host']}/summary\u003c/td\u003e\u003c/tr\u003e\n\u003c/tbody\u003e\u003c/table\u003e\u003c/p\u003e"
+ }
+ },
+ "Update_incident_Tags": {
+ "runAfter": {
+ "Add_comment_to_incident": [
+ "Succeeded"
+ ]
+ },
+ "type": "ApiConnection",
+ "inputs": {
+ "body": {
+ "incidentArmId": "@triggerBody()?['object']?['id']",
+ "tagsToAdd": {
+ "TagsToAdd": [
+ {
+ "Tag": "@items('For_each_Threat_IoC')?['type']"
+ },
+ {
+ "Tag": "Imported: @{items('For_each_Threat_IoC')?['imported']}"
+ },
+ {
+ "Tag": "Profile: @{items('For_each_Threat_IoC')?['profile']}"
+ },
+ {
+ "Tag": "Property: @{items('For_each_Threat_IoC')?['property']}"
+ },
+ {
+ "Tag": "Threat Level: @{items('For_each_Threat_IoC')?['threat_level']}"
+ }
+ ]
+ }
+ },
+ "host": {
+ "connection": {
+ "name": "@parameters('$connections')['azuresentinel']['connectionId']"
+ }
+ },
+ "method": "put",
+ "path": "/Incidents"
+ }
+ }
+ }
+ },
+ "expression": {
+ "and": [
+ {
+ "equals": [
+ "@body('Parse_JSON')?['record_count']",
+ 0
+ ]
+ }
+ ]
+ },
+ "type": "If"
+ }
+ },
+ "runAfter": {
+ "Parse_JSON": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "HTTP_-_Get_TIDE_Data_(Hosts)": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "headers": {
+ "Authorization": "Token @{parameters('TIDE API Key')}"
+ },
+ "method": "GET",
+ "queries": {
+ "host": "@items('For_each_DNS_Domain_Entity')?['DomainName']",
+ "rlimit": "1"
+ },
+ "uri": "https://csp.infoblox.com/tide/api/data/threats"
+ }
+ },
+ "Parse_JSON": {
+ "runAfter": {
+ "HTTP_-_Get_TIDE_Data_(Hosts)": [
+ "Succeeded"
+ ]
+ },
+ "type": "ParseJson",
+ "inputs": {
+ "content": "@body('HTTP_-_Get_TIDE_Data_(Hosts)')",
+ "schema": {
+ "properties": {
+ "record_count": {
+ "type": "integer"
+ },
+ "threat": {
+ "items": {
+ "properties": {
+ "batch_id": {
+ "type": "string"
+ },
+ "class": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "integer"
+ },
+ "confidence_score": {
+ "type": "number"
+ },
+ "confidence_score_rating": {
+ "type": "string"
+ },
+ "confidence_score_vector": {
+ "type": "string"
+ },
+ "detected": {
+ "type": "string"
+ },
+ "dga": {
+ },
+ "domain": {
+ "type": "string"
+ },
+ "email": {
+ "type": "string"
+ },
+ "expiration": {
+ "type": "string"
+ },
+ "extended": {
+ "properties": {
+ "ais_consent": {
+ "type": "string"
+ },
+ "cyberint_guid": {
+ "type": "string"
+ },
+ "no_whitelist": {
+ "type": "string"
+ },
+ "notes": {
+ "type": "string"
+ },
+ "protocol": {
+ "type": "string"
+ },
+ "url_hash": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "hash": {
+ "type": "string"
+ },
+ "hash_type": {
+ "type": "string"
+ },
+ "host": {
+ "type": "string"
+ },
+ "id": {
+ "type": "string"
+ },
+ "imported": {
+ "type": "string"
+ },
+ "ip": {
+ "type": "string"
+ },
+ "profile": {
+ "type": "string"
+ },
+ "property": {
+ "type": "string"
+ },
+ "received": {
+ "type": "string"
+ },
+ "risk_score": {
+ "type": "number"
+ },
+ "risk_score_rating": {
+ "type": "string"
+ },
+ "risk_score_vector": {
+ "type": "string"
+ },
+ "threat_level": {
+ "type": "integer"
+ },
+ "threat_score": {
+ "type": "number"
+ },
+ "threat_score_rating": {
+ "type": "string"
+ },
+ "threat_score_vector": {
+ "type": "string"
+ },
+ "tld": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ },
+ "up": {
+ },
+ "url": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "id"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ }
+ }
+ }
+ },
+ "runAfter": {
+ "Entities_-_Get_DNS": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "Initialize_HTML": {
+ "runAfter": {
+ },
+ "type": "InitializeVariable",
+ "inputs": {
+ "variables": [
+ {
+ "name": "html",
+ "type": "string"
+ }
+ ]
+ }
+ }
+ },
+ "outputs": {
+ }
+ },
+ "parameters": {
+ "$connections": {
+ "value": {
+ "azuresentinel": {
+ "connectionId": "[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]",
+ "connectionName": "[variables('MicrosoftSentinelConnectionName')]",
+ "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/Azuresentinel')]",
+ "connectionProperties": {
+ "authentication": {
+ "type": "ManagedServiceIdentity"
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "name": "[parameters('PlaybookName')]",
+ "type": "Microsoft.Logic/workflows",
+ "location": "[resourceGroup().location]",
+ "tags": {
+ "hidden-SentinelTemplateName": "Infoblox-Incident-Enrichment-Domains",
+ "hidden-SentinelTemplateVersion": "1.0"
+ },
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "apiVersion": "2017-07-01",
+ "dependsOn": [
+ "[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]"
+ ]
+ },
+ {
+ "type": "Microsoft.Web/connections",
+ "apiVersion": "2016-06-01",
+ "name": "[variables('MicrosoftSentinelConnectionName')]",
+ "location": "[resourceGroup().location]",
+ "kind": "V1",
+ "properties": {
+ "displayName": "[variables('MicrosoftSentinelConnectionName')]",
+ "customParameterValues": {
+ },
+ "parameterValueType": "Alternative",
+ "api": {
+ "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/Azuresentinel')]"
+ }
+ }
+ }
+ ]
+}
diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Incident-Send-Email/azuredeploy.json b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Incident-Send-Email/azuredeploy.json
new file mode 100644
index 00000000000..c37598c5ece
--- /dev/null
+++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Incident-Send-Email/azuredeploy.json
@@ -0,0 +1,530 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "1.0.0.0",
+ "metadata": {
+ "title": "Infoblox Incident Send Email",
+ "description": "Sends a detailed email when an incident occurs. Optionally enriches an applicable entity within the email with Infoblox TIDE data. This playbook can be configured to run automatically when an incident occurs (recommended) or run on demand.",
+ "prerequisites": [
+ "Infoblox TIDE API key (optional)."
+ ],
+ "postDeployment": [
+ "1. Grant playbook's Managed Identity **Microsoft Sentinel Responder** or greater to Resource Group.",
+ "2. Authorize connections."
+ ],
+ "prerequisitesDeployTemplateFile": "",
+ "lastUpdateTime": "2023-08-07T00:00:00.000Z",
+ "entities": [ "DnsResolution"
+ ],
+ "tags": [ "Enrichment", "Notification"
+ ],
+ "support": {
+ "tier": "community",
+ "armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator"
+ },
+ "author": {
+ "name": "Infoblox"
+ }
+ },
+ "parameters": {
+ "PlaybookName": {
+ "defaultValue": "Infoblox-Incident-Send-Email",
+ "type": "string"
+ },
+ "Email Recipient": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for Email Recipient"
+ }
+ },
+ "TIDE API Key": {
+ "type": "string",
+ "metadata": {
+ "description": "Enter value for TIDE API Key"
+ }
+ }
+ },
+ "variables": {
+ "MicrosoftSentinelConnectionName": "[concat('MicrosoftSentinel-', parameters('PlaybookName'))]",
+ "Office365ConnectionName": "[concat('Office365-', parameters('PlaybookName'))]"
+ },
+ "resources": [
+ {
+ "properties": {
+ "provisioningState": "Succeeded",
+ "state": "Disabled",
+ "definition": {
+ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "$connections": {
+ "defaultValue": {
+ },
+ "type": "Object"
+ },
+ "Email Recipient": {
+ "defaultValue": "[parameters('Email Recipient')]",
+ "type": "string"
+ },
+ "TIDE API Key": {
+ "defaultValue": "[parameters('TIDE API Key')]",
+ "type": "string"
+ }
+ },
+ "triggers": {
+ "Microsoft_Sentinel_incident": {
+ "type": "ApiConnectionWebhook",
+ "inputs": {
+ "body": {
+ "callback_url": "@{listCallbackUrl()}"
+ },
+ "host": {
+ "connection": {
+ "name": "@parameters('$connections')['azuresentinel']['connectionId']"
+ }
+ },
+ "path": "/incident-creation"
+ }
+ }
+ },
+ "actions": {
+ "Create_HTML_table_with_Entities": {
+ "runAfter": {
+ "Select_Entities": [
+ "Succeeded"
+ ]
+ },
+ "type": "Table",
+ "inputs": {
+ "format": "HTML",
+ "from": "@body('Select_Entities')"
+ }
+ },
+ "Entities_-_Get_DNS": {
+ "runAfter": {
+ "Set_Entities_HTML": [
+ "Succeeded"
+ ]
+ },
+ "type": "ApiConnection",
+ "inputs": {
+ "body": "@triggerBody()?['object']?['properties']?['relatedEntities']",
+ "host": {
+ "connection": {
+ "name": "@parameters('$connections')['azuresentinel']['connectionId']"
+ }
+ },
+ "method": "post",
+ "path": "/entities/dnsresolution"
+ }
+ },
+ "For_each_DNS_Domain_Entity": {
+ "foreach": "@body('Entities_-_Get_DNS')?['Dnsresolutions']",
+ "actions": {
+ "For_each_Threat_IoC": {
+ "foreach": "@body('Parse_JSON')?['threat']",
+ "actions": {
+ "Enrich_Email_with_TIDE_Data_if_it_exists": {
+ "actions": {
+ },
+ "runAfter": {
+ },
+ "else": {
+ "actions": {
+ "Append_HTML_Table_with_TIDE_Data": {
+ "runAfter": {
+ },
+ "type": "AppendToStringVariable",
+ "inputs": {
+ "name": "html_tide",
+ "value": "\u003cstyle\u003e\n@{variables('css')}\n\u003c/style\u003e\n\u003cdiv class=\"title\"\u003eIoC - @{items('For_each_DNS_Domain_Entity')?['DomainName']} - @{items('For_each_Threat_IoC')?['type']} - @{items('For_each_Threat_IoC')?['class']}\u003c/div\u003e\n\u003ctable class=\"table\"\u003e\u003ctbody\u003e \n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eID\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['id']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eType\u003c/td\u003e\n\u003ctd class=\"tvalue\" \u003e@{items('For_each_Threat_IoC')?['type']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eHost\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['host']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eDomain\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['domain']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eURL\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['url']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eIP\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['ip']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctd class=\"tkey\"\u003eEmail\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['email']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eHash\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['hash']} @{items('For_each_Threat_IoC')?['hash_type']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eProfile\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['profile']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eProperty\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['property']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eThreat Level\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['threat_level']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eConfidence\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['confidence']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eDetected\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['detected']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eReceived\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['received']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eImported\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['imported']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eExpiration\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['expiration']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eDescription\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['extended']?['notes']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eOpen in CSP\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003ehttps://csp.infoblox.com/#/security_research/search/auto/@{items('For_each_Threat_IoC')?['host']}/summary\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e"
+ }
+ }
+ }
+ },
+ "expression": {
+ "and": [
+ {
+ "equals": [
+ "@body('Parse_JSON')?['record_count']",
+ 0
+ ]
+ }
+ ]
+ },
+ "type": "If"
+ }
+ },
+ "runAfter": {
+ "Parse_JSON": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "HTTP_-_Get_TIDE_Data_(Hosts)": {
+ "runAfter": {
+ },
+ "type": "Http",
+ "inputs": {
+ "headers": {
+ "Authorization": "Token @{parameters('TIDE API Key')}"
+ },
+ "method": "GET",
+ "queries": {
+ "host": "@items('For_each_DNS_Domain_Entity')?['DomainName']",
+ "rlimit": "1"
+ },
+ "uri": "https://csp.infoblox.com/tide/api/data/threats"
+ }
+ },
+ "Parse_JSON": {
+ "runAfter": {
+ "HTTP_-_Get_TIDE_Data_(Hosts)": [
+ "Succeeded"
+ ]
+ },
+ "type": "ParseJson",
+ "inputs": {
+ "content": "@body('HTTP_-_Get_TIDE_Data_(Hosts)')",
+ "schema": {
+ "properties": {
+ "record_count": {
+ "type": "integer"
+ },
+ "threat": {
+ "items": {
+ "properties": {
+ "batch_id": {
+ "type": "string"
+ },
+ "class": {
+ "type": "string"
+ },
+ "confidence": {
+ "type": "integer"
+ },
+ "confidence_score": {
+ "type": "number"
+ },
+ "confidence_score_rating": {
+ "type": "string"
+ },
+ "confidence_score_vector": {
+ "type": "string"
+ },
+ "detected": {
+ "type": "string"
+ },
+ "dga": {
+ },
+ "domain": {
+ "type": "string"
+ },
+ "email": {
+ "type": "string"
+ },
+ "expiration": {
+ "type": "string"
+ },
+ "extended": {
+ "properties": {
+ "ais_consent": {
+ "type": "string"
+ },
+ "cyberint_guid": {
+ "type": "string"
+ },
+ "no_whitelist": {
+ "type": "string"
+ },
+ "notes": {
+ "type": "string"
+ },
+ "protocol": {
+ "type": "string"
+ },
+ "url_hash": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "hash": {
+ "type": "string"
+ },
+ "hash_type": {
+ "type": "string"
+ },
+ "host": {
+ "type": "string"
+ },
+ "id": {
+ "type": "string"
+ },
+ "imported": {
+ "type": "string"
+ },
+ "ip": {
+ "type": "string"
+ },
+ "profile": {
+ "type": "string"
+ },
+ "property": {
+ "type": "string"
+ },
+ "received": {
+ "type": "string"
+ },
+ "risk_score": {
+ "type": "number"
+ },
+ "risk_score_rating": {
+ "type": "string"
+ },
+ "risk_score_vector": {
+ "type": "string"
+ },
+ "threat_level": {
+ "type": "integer"
+ },
+ "threat_score": {
+ "type": "number"
+ },
+ "threat_score_rating": {
+ "type": "string"
+ },
+ "threat_score_vector": {
+ "type": "string"
+ },
+ "tld": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ },
+ "up": {
+ },
+ "url": {
+ "type": "string"
+ }
+ },
+ "required": [
+ "id"
+ ],
+ "type": "object"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ }
+ }
+ }
+ },
+ "runAfter": {
+ "Entities_-_Get_DNS": [
+ "Succeeded"
+ ]
+ },
+ "type": "Foreach"
+ },
+ "Initialize_CSS": {
+ "runAfter": {
+ "Initialize_Incident_HTML": [
+ "Succeeded"
+ ]
+ },
+ "type": "InitializeVariable",
+ "inputs": {
+ "variables": [
+ {
+ "name": "css",
+ "type": "string",
+ "value": ".title {\n color: #1F2A47;\n font-size: 2rem;\n letter-spacing: .04em;\n padding: 8px;\n border-bottom: 1px solid #7B7B7B;\n font-weight: bold;\n}\n\ntable {\n border-collapse: collapse;\n border-spacing: 0;\n padding: 0;\n margin: 0 0 20px;\n}\n\n.tkey {\n text-align: right;\n border-right: 1px solid #7B7B7B;\n}\n.tvalue {\n text-align: left;\n border-top: 1px solid #eee !important;\n padding-left: 10px;\n}\n.value {\n font-size: 1.4rem;\n font-weight: bold;\n}\n\n.tkey, .key{\n color: #263137;\n letter-spacing: .04em;\n font-style: italic;\n padding-right: 10px;\n}\n.tvalue, .value {\n color: #1f4728 !important;\n letter-spacing: .02rem;\n}\n\n"
+ }
+ ]
+ }
+ },
+ "Initialize_Entities_HTML": {
+ "runAfter": {
+ "Initialize_CSS": [
+ "Succeeded"
+ ]
+ },
+ "type": "InitializeVariable",
+ "inputs": {
+ "variables": [
+ {
+ "name": "html_entities",
+ "type": "string"
+ }
+ ]
+ }
+ },
+ "Initialize_Incident_HTML": {
+ "runAfter": {
+ "Initialize_TIDE_HTML": [
+ "Succeeded"
+ ]
+ },
+ "type": "InitializeVariable",
+ "inputs": {
+ "variables": [
+ {
+ "name": "html_incident",
+ "type": "string"
+ }
+ ]
+ }
+ },
+ "Initialize_TIDE_HTML": {
+ "runAfter": {
+ },
+ "type": "InitializeVariable",
+ "inputs": {
+ "variables": [
+ {
+ "name": "html_tide",
+ "type": "string"
+ }
+ ]
+ }
+ },
+ "Select_Entities": {
+ "runAfter": {
+ "Initialize_Entities_HTML": [
+ "Succeeded"
+ ]
+ },
+ "type": "Select",
+ "inputs": {
+ "from": "@triggerBody()?['object']?['properties']?['relatedEntities']",
+ "select": {
+ "Entity": "@item()?['properties']?['friendlyName']",
+ "Type": "@item()?['kind']"
+ }
+ }
+ },
+ "Send_an_email_with_Incident_details": {
+ "runAfter": {
+ "Set_Incident_HTML": [
+ "Succeeded"
+ ]
+ },
+ "type": "ApiConnection",
+ "inputs": {
+ "body": {
+ "Body": "\u003cp\u003e\u003cspan style=\"font-size: 14px\"\u003e\u003c/span\u003e\u003cspan style=\"font-size: 14px\"\u003e@{variables('html_incident')}\u003c/span\u003e\u003cspan style=\"font-size: 14px\"\u003e\u003cbr\u003e\n\u003c/span\u003e\u003cspan style=\"font-size: 14px\"\u003e@{variables('html_tide')}\u003c/span\u003e\u003cspan style=\"font-size: 14px\"\u003e\u003c/span\u003e\u003c/p\u003e",
+ "Importance": "Normal",
+ "Subject": "New Sentinel Incident - @{triggerBody()?['object']?['properties']?['title']}",
+ "To": "@parameters('Email Recipient')"
+ },
+ "host": {
+ "connection": {
+ "name": "@parameters('$connections')['office365_1']['connectionId']"
+ }
+ },
+ "method": "post",
+ "path": "/v2/Mail"
+ }
+ },
+ "Set_Entities_HTML": {
+ "runAfter": {
+ "Create_HTML_table_with_Entities": [
+ "Succeeded"
+ ]
+ },
+ "type": "SetVariable",
+ "inputs": {
+ "name": "html_entities",
+ "value": "\u003cstyle\u003e\n@{variables('css')}\ntable, table td, table th {\n text-align: left;\n color: #1f4728 !important;\n border-top: 1px solid #eee !important;\n letter-spacing: .02rem;\n padding-left: 10px;\n}\n\u003c/style\u003e\n@{body('Create_HTML_table_with_Entities')}\n"
+ }
+ },
+ "Set_Incident_HTML": {
+ "runAfter": {
+ "For_each_DNS_Domain_Entity": [
+ "Succeeded"
+ ]
+ },
+ "type": "SetVariable",
+ "inputs": {
+ "name": "html_incident",
+ "value": "\u003cstyle\u003e\n@{variables('css')}\np {\n margin-bottom: 15px !important;\n}\n\u003c/style\u003e\n\u003cdiv class=\"title\"\u003e New incident created in Microsoft Sentinel \u003c/div\u003e\n\n\u003cp\u003e\u003cspan class=\"key\"\u003e Triggered - \u003c/span \u003e\u003cspan class=\"value\"\u003e@{triggerBody()?['object']?['properties']?['title']} \u003c/span \u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cspan class=\"key\"\u003e Incident ID - \u003c/span\u003e\u003cspan class=\"value\"\u003e @{triggerBody()?['object']?['properties']?['incidentNumber']}\u003c/span\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cspan class=\"key\"\u003e Triggered on - \u003c/span \u003e\u003cspan class=\"value\"\u003e @{triggerBody()?['object']?['properties']?['createdTimeUtc']}\u003c/span\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cspan class=\"key\"\u003e Severity - \u003c/span \u003e\u003cspan class=\"value\"\u003e@{triggerBody()?['object']?['properties']?['severity']}\u003c/span\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cspan class=\"key\"\u003e Alert providers - \u003c/span \u003e\u003cspan class=\"value\"\u003e@{join(triggerBody()?['object']?['properties']?['additionalData']?['alertProductNames'], '\u003cbr /\u003e')}\u003c/span\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cspan class=\"key\"\u003e Tactics - \u003c/span \u003e\u003cspan class=\"value\"\u003e\n@{join(triggerBody()?['object']?['properties']?['additionalData']?['tactics'], '\u003cbr /\u003e')}\u003c/span\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cspan class=\"key\"\u003e Description - \u003c/span \u003e\u003cspan class=\"value\"\u003e\n@{triggerBody()?['object']?['properties']?['description']}\u003c/span\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cspan class=\"key\"\u003e Entities - \u003c/span \u003e\u003cspan class=\"value\"\u003e\n@{variables('html_entities')}\u003c/span\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cspan class=\"key\"\u003e Incident link - \u003c/span \u003e\u003cspan class=\"value\"\u003e\n\u003ca href=\"@{triggerBody()?['object']?['properties']?['incidentUrl']}\"\u003e@{triggerBody()?['object']?['properties']?['incidentUrl']}\u003c/a\u003e\u003c/span\u003e\u003c/p\u003e\n\n\u003cdiv class=\"title\"\u003e TIDE Data \u003c/div \u003e"
+ }
+ }
+ },
+ "outputs": {
+ }
+ },
+ "parameters": {
+ "$connections": {
+ "value": {
+ "azuresentinel": {
+ "connectionId": "[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]",
+ "connectionName": "[variables('MicrosoftSentinelConnectionName')]",
+ "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/Azuresentinel')]",
+ "connectionProperties": {
+ "authentication": {
+ "type": "ManagedServiceIdentity"
+ }
+ }
+ },
+ "office365_1": {
+ "connectionId": "[resourceId('Microsoft.Web/connections', variables('Office365ConnectionName'))]",
+ "connectionName": "[variables('Office365ConnectionName')]",
+ "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/Office365')]"
+ }
+ }
+ }
+ }
+ },
+ "name": "[parameters('PlaybookName')]",
+ "type": "Microsoft.Logic/workflows",
+ "location": "[resourceGroup().location]",
+ "tags": {
+ "hidden-SentinelTemplateName": "Infoblox-Incident-Send-Email",
+ "hidden-SentinelTemplateVersion": "1.0"
+ },
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "apiVersion": "2017-07-01",
+ "dependsOn": [
+ "[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]",
+ "[resourceId('Microsoft.Web/connections', variables('Office365ConnectionName'))]"
+ ]
+ },
+ {
+ "type": "Microsoft.Web/connections",
+ "apiVersion": "2016-06-01",
+ "name": "[variables('MicrosoftSentinelConnectionName')]",
+ "location": "[resourceGroup().location]",
+ "kind": "V1",
+ "properties": {
+ "displayName": "[variables('MicrosoftSentinelConnectionName')]",
+ "customParameterValues": {
+ },
+ "parameterValueType": "Alternative",
+ "api": {
+ "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/Azuresentinel')]"
+ }
+ }
+ },
+ {
+ "type": "Microsoft.Web/connections",
+ "apiVersion": "2016-06-01",
+ "name": "[variables('Office365ConnectionName')]",
+ "location": "[resourceGroup().location]",
+ "kind": "V1",
+ "properties": {
+ "displayName": "[variables('Office365ConnectionName')]",
+ "customParameterValues": {
+ },
+ "api": {
+ "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/Office365')]"
+ }
+ }
+ }
+ ]
+}
diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/images/email.jpg b/Solutions/Infoblox Cloud Data Connector/Playbooks/images/email.jpg
new file mode 100644
index 00000000000..c856805881e
Binary files /dev/null and b/Solutions/Infoblox Cloud Data Connector/Playbooks/images/email.jpg differ
diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/images/incident.jpg b/Solutions/Infoblox Cloud Data Connector/Playbooks/images/incident.jpg
new file mode 100644
index 00000000000..1dca3634146
Binary files /dev/null and b/Solutions/Infoblox Cloud Data Connector/Playbooks/images/incident.jpg differ
diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/images/infoblox.png b/Solutions/Infoblox Cloud Data Connector/Playbooks/images/infoblox.png
new file mode 100644
index 00000000000..de860ad91de
Binary files /dev/null and b/Solutions/Infoblox Cloud Data Connector/Playbooks/images/infoblox.png differ
diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/images/tide.jpg b/Solutions/Infoblox Cloud Data Connector/Playbooks/images/tide.jpg
new file mode 100644
index 00000000000..01eb6fd9e39
Binary files /dev/null and b/Solutions/Infoblox Cloud Data Connector/Playbooks/images/tide.jpg differ
diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/readme.md b/Solutions/Infoblox Cloud Data Connector/Playbooks/readme.md
new file mode 100644
index 00000000000..707ce93dc34
--- /dev/null
+++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/readme.md
@@ -0,0 +1,141 @@
+# Infoblox Threat Intelligence Playbooks for Microsoft Sentinel
+[
](https://www.infoblox.com/)
+
+These playbooks integrate Infoblox [Threat Intelligence Data Exchange (TIDE)](https://docs.infoblox.com/space/BloxOneThreatDefense/35898533)
+data into Microsoft Sentinel.
+
+Use these playbooks to import data from TIDE and enrich incidents and emails.
+
+# Prerequisites
+1. Register an app with Azure Active Directory and apply appropriate permissions, and enable the Threat Intelligence data connector.
+Find instructions [here](https://learn.microsoft.com/en-us/azure/sentinel/connect-threat-intelligence-tip).
+
+2. Apply the **Microsoft Sentinel Contributor** or **Microsoft Sentinel Responder** role to the playbooks.
+It is recommended to assign the role to the resource group that contains your Microsoft Sentinel workspace.
+Find instructions [here](https://learn.microsoft.com/en-us/azure/sentinel/roles).
+
+3. Create and copy a TIDE API key into the playbook parameters.
+Find instructions [here](https://docs.infoblox.com/space/BloxOneThreatDefense/230394187).
+
+# Installation
+There are multiple ways to install the playbooks.
+- Install the solution from the [Content Hub](https://portal.azure.com/#view/Microsoft_Azure_Marketplace/GalleryItemDetailsBladeNopdl/dontDiscardJourney~/true/id/infoblox.infoblox-cdc-solution/resourceGroupId/%2Fsubscriptions%2Fbe1e61b7-8dbe-4986-a9c2-d85f65524d6e%2FresourceGroups%2Ftme-rg)
+(Recommended). This will not only install the playbook templates, but the other Sentinel templates as part of this solution as well.
+- Copy and paste the ```azuredeploy.json``` files to a blank playbook.
+- Click the **Deploy to Azure** buttons below for each desired playbook.
+
+# The Playbooks
+This solution installs several playbooks that fit different needs.
+You may wish to mix and match, omit some or modify others.
+
+## Intelligence Import
+These playbooks import TIDE intelligence using the Infoblox TIDE API and send the indicators to Microsoft Sentinel via the Microsoft Security Graph API.
+The indicators are stored in the ```ThreatIntelligenceIndicator``` table and can be viewed from the **Threat intelligence** blade.
+
+Because there are millions of indicators provided by TIDE, and thousands of new ones detected per day,
+these playbooks are intended to give you a starting point for importing the indicators you want.
+
+
+You may wish to import everything, or you may only need a handful of threat classes from a single profile or provider.
+
+
+You can modify or create copies of these playbooks and tweak the action **Get TIDE Data** API call within the playbook to suit your needs.
+Keep in mind due to [current limitations](https://learn.microsoft.com/en-us/azure/logic-apps/logic-apps-limits-and-config?tabs=consumption%2Cazure-portal), there is a 105MB download limit per API call and a 120 second HTTP timeout.
+This is why you may only need to import new emails on a weekly basis, whereas hosts should be imported more frequently with an ```rlimit``` parameter because there are so many more.
+
+
+
+Use the following TIDE endpoints to see what is available for you to import. You can also view indicators in the [CSP](https://csp.infoblox.com/#/threat_intelligence/active-threat-indicators).
+
+***GET** available threat properties* - ```/tide/api/data/properties```
+
+***GET** available threat classes* - ```/tide/api/data/threat_classes```
+
+***GET** available profiles (data providers)* - ```/tide/api/entitlements/profiles```
+
+View the list of APIs [here](https://csp.infoblox.com/apidoc?url=https%3A%2F%2Fcsp.infoblox.com%2Fapidoc%2Fdocs%2FTIDEData).
+
+Find a quick technical intro and examples for how to query TIDE data [here](https://docs.infoblox.com/space/BloxOneThreatDefense/117014574/Query+Active+Threats).
+
+---
+### Import-AISCOMM-Weekly
+This playbook imports all indicators from the AISCOMM data provider on a scheduled weekly basis.
+
+[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-AISCOMM-Weekly%2Fazuredeploy.json)
+[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-AISCOMM-Weekly%2Fazuredeploy.json)
+---
+### Import-Emails-Weekly
+This playbook imports newly detected emails on a scheduled weekly basis.
+
+[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Emails-Weekly%2Fazuredeploy.json)
+[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Emails-Weekly%2Fazuredeploy.json)
+---
+### Import-Hashes-Weekly
+This playbook imports newly detected hashes on a scheduled weekly basis.
+
+[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Hashes-Weekly%2Fazuredeploy.json)
+[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Hashes-Weekly%2Fazuredeploy.json)
+---
+### Import-Hosts-Daily-LookalikeDomains
+This playbook imports newly detected Lookalike domains on a scheduled daily basis.
+
+[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Hosts-Daily-LookalikeDomains%2Fazuredeploy.json)
+[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Hosts-Daily-LookalikeDomains%2Fazuredeploy.json)
+---
+### Import-Hosts-Daily-MalwareC2DGA
+This playbook imports newly detected MalwareC2DGA domains on a scheduled daily basis.
+
+[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Hosts-Daily-MalwareC2DGA%2Fazuredeploy.json)
+[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Hosts-Daily-MalwareC2DGA%2Fazuredeploy.json)
+---
+### Import-Hosts-Daily-Phishing
+This playbook imports newly detected Phishing domains on a scheduled daily basis.
+
+[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Hosts-Daily-Phishing%2Fazuredeploy.json)
+[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Hosts-Daily-Phishing%2Fazuredeploy.json)
+---
+### Import-Hosts-Hourly
+This playbook imports all newly detected hosts on a scheduled hourly basis.
+
+This playbook will import thousands of IoCs per run, which can become costly for your organization.
+It will also create duplicates if concurrently enabled with the Import-Hosts-Daily playbooks, so use one or the other.
+
+[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Hosts-Hourly%2Fazuredeploy.json)
+[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Hosts-Hourly%2Fazuredeploy.json)
+---
+### Import-IPs-Hourly
+This playbook imports all newly detected IPs on a scheduled hourly basis.
+
+[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-IPs-Hourly%2Fazuredeploy.json)
+[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-IPs-Hourly%2Fazuredeploy.json)
+---
+### Import-URLs-Daily
+This playbook imports all newly detected URLs on a scheduled hourly basis.
+
+[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-URLs-Daily%2Fazuredeploy.json)
+[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-URLs-Daily%2Fazuredeploy.json)
+
+## Enrichment & Emails
+Enrich your incidents and emails with TIDE data.
+
+These playbooks can be configured to run automatically on Analytic Rules. Find instructions [here](https://learn.microsoft.com/en-us/azure/sentinel/detect-threats-custom#set-automated-responses-and-create-the-rule).
+
+You can also run them on demand when viewing incidents.
+
+---
+### Incident-Enrichment-Domains
+Enrich incidents containing a **DNS entity** with rich TIDE data. Will add a comment and tags to the incident.
+
+
+[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Incident-Enrichment-Domains%2Fazuredeploy.json)
+[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Incident-Enrichment-Domains%2Fazuredeploy.json)
+---
+
+### Incident-Send-Email
+Sends a detailed email about an incident. Enriches a **DNS entity** within the email with Infoblox TIDE data.
+
+
+
+[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Incident-Send-Email%2Fazuredeploy.json)
+[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Incident-Send-Email%2Fazuredeploy.json)
+
diff --git a/Solutions/Infoblox Cloud Data Connector/ReleaseNotes.md b/Solutions/Infoblox Cloud Data Connector/ReleaseNotes.md
new file mode 100644
index 00000000000..8b886d69cf5
--- /dev/null
+++ b/Solutions/Infoblox Cloud Data Connector/ReleaseNotes.md
@@ -0,0 +1,14 @@
+| **Version** | **Date Modified** | **Change History** |
+|---------------|--------------------------------|---------------------------------------------|
+| 3.0.0 | Aug 2023 | Bug fixes
+| | | Documentation updates
+| | | Update Infoblox logo
+| | | **Analytic Rules** Optimization updates. 5 new rules
+| | | **Playbooks** 11 new playbooks
+| 2.0.1-2.0.10 | May 2022-June 2023 | Bug fixes
+| | | Documentation updates
+| 1.0.0-1.1.0 | April 2021-Oct 2021 | Initial solution release |
+| | | **Data Connector** New custom data connector for the Infoblox CDC
+| | | **Analytic Rules** 3 new rules
+| | | **Parser** 1 new parser
+| | | **Workbook** 1 new workbook
diff --git a/Solutions/Infoblox Cloud Data Connector/SolutionMetadata.json b/Solutions/Infoblox Cloud Data Connector/SolutionMetadata.json
index bf5fc36aae1..7503659713e 100644
--- a/Solutions/Infoblox Cloud Data Connector/SolutionMetadata.json
+++ b/Solutions/Infoblox Cloud Data Connector/SolutionMetadata.json
@@ -2,14 +2,14 @@
"publisherId": "infoblox",
"offerId": "infoblox-cdc-solution",
"firstPublishDate": "2021-10-20",
- "providers": ["InfoBlox"],
+ "providers": ["Infoblox"],
"categories": {
- "domains" : ["Security - Threat Protection"],
+ "domains" : ["Networking", "Security - Threat Protection", "Security - Network", "Security - Threat Intelligence" ],
"verticals": []
},
"support": {
- "name": "InfoBlox",
+ "name": "Infoblox",
"tier": "Partner",
"link": "https://support.infoblox.com/"
}
-}
\ No newline at end of file
+}