Skip to content

Commit

Permalink
Deployment and document-section link updates for Azure Org
Browse files Browse the repository at this point in the history
  • Loading branch information
AcceleryntSecurityDev committed Aug 17, 2023
1 parent 6ec7185 commit 6c62458
Show file tree
Hide file tree
Showing 44 changed files with 14 additions and 14 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@ Author: Accelerynt

For any technical questions, please contact info@accelerynt.com

[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.Googleusercontent.com%2FAccelerynt-Security%2FAS-Sign-Out-Google-User%2Fmain%2Fazuredeploy.json)
[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.Googleusercontent.com%2FAccelerynt-Security%2FAS-Sign-Out-Google-User%2Fmain%2Fazuredeploy.json)
[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FAS-Sign-Out-Google-Userazuredeploy.json)
[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FAS-Sign-Out-Google-Userazuredeploy.json)

This playbook is intended to be run from a Microsoft Sentinel Incident. It will look up the Google Users associated with the Incident Account Entities and sign them out of all Google web and device sessions. This action also resets user sign-in cookies and forces them to reauthenticate. A comment noting the affected Google Users will be added to the Incident.

Expand All @@ -20,11 +20,11 @@ This playbook is intended to be run from a Microsoft Sentinel Incident. It will
The following items are required under the template settings during deployment:

* A [Google Service Account](https://Google.com/Accelerynt-Security/AS-Sign-Out-Google-User#create-a-google-service-account) with the proper scope and role configurations
* A [Private Key](https://Google.com/Accelerynt-Security/AS-Sign-Out-Google-User#create-a-private-key) in JSON format for your Google Service Account
* An [Azure Key Vault Secret](https://Google.com/Accelerynt-Security/AS-Sign-Out-Google-User#create-an-azure-key-vault-secret) containing your private key
* Install [Visual Studio Code](https://Google.com/Accelerynt-Security/AS-Sign-Out-Google-User#configure-visual-studio-code) and configure it to deploy an Azure Function to your Azure tenant
* An [Azure Function App](https://Google.com/Accelerynt-Security/AS-Sign-Out-Google-User#deploy-the-azure-function-app) that supports Python to deploy an Azure function to
* A [Google Service Account](https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/AS-Sign-Out-Google-User#create-a-google-service-account) with the proper scope and role configurations
* A [Private Key](https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/AS-Sign-Out-Google-User#create-a-private-key) in JSON format for your Google Service Account
* An [Azure Key Vault Secret](https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/AS-Sign-Out-Google-User#create-an-azure-key-vault-secret) containing your private key
* Install [Visual Studio Code](https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/AS-Sign-Out-Google-User#configure-visual-studio-code) and configure it to deploy an Azure Function to your Azure tenant
* An [Azure Function App](https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/AS-Sign-Out-Google-User#deploy-the-azure-function-app) that supports Python to deploy an Azure function to


#
Expand Down Expand Up @@ -90,11 +90,11 @@ Navigate to an existing Key Vault or create a new one. From the Key Vault overvi

![SignOutGoogleUser_Key_Vault_Create_Secret_1](Images/SignOutGoogleUser_Key_Vault_Create_Secret_1.png)

Choose a name for the secret, such as "**Google-App-Private-Key--Sign-Out-User**", and enter the Google private key JSON copied from the [previous step](https://Google.com/Accelerynt-Security/AS-Sign-Out-Google-User#encode-the-private-key-for-storage-compatibility-in-azure-key-vault) in the "**Value**" field. All other settings can be left as is. Click "**Create**".
Choose a name for the secret, such as "**Google-App-Private-Key--Sign-Out-User**", and enter the Google private key JSON copied from the [previous step](https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/AS-Sign-Out-Google-User#encode-the-private-key-for-storage-compatibility-in-azure-key-vault) in the "**Value**" field. All other settings can be left as is. Click "**Create**".

![SignOutGoogleUser_Key_Vault_Create_Secret_2](Images/SignOutGoogleUser_Key_Vault_Create_Secret_2.png)

Once your secret has been added to the vault, navigate to the "**Access policies**" menu option on the Key Vault page menu. Leave this page open, as you will need to return to it once the playbook has been deployed. See [Granting Access to Azure Key Vault](https://Google.com/Accelerynt-Security/AS-Sign-Out-Google-User#granting-access-to-azure-key-vault).
Once your secret has been added to the vault, navigate to the "**Access policies**" menu option on the Key Vault page menu. Leave this page open, as you will need to return to it once the playbook has been deployed. See [Granting Access to Azure Key Vault](https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/AS-Sign-Out-Google-User#granting-access-to-azure-key-vault).

![SignOutGoogleUser_Key_Vault_Create_Secret_3](Images/SignOutGoogleUser_Key_Vault_Create_Secret_3.png)

Expand Down Expand Up @@ -204,8 +204,8 @@ Open your browser and ensure you are logged into your Microsoft Sentinel workspa

https://Google.com/Accelerynt-Security/AS-Sign-Out-Google-User

[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.Googleusercontent.com%2FAccelerynt-Security%2FAS-Sign-Out-Google-User%2Fmain%2Fazuredeploy.json)
[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.Googleusercontent.com%2FAccelerynt-Security%2FAS-Sign-Out-Google-User%2Fmain%2Fazuredeploy.json)
[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FAS-Sign-Out-Google-Userazuredeploy.json)
[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FAS-Sign-Out-Google-Userazuredeploy.json)

Click the "**Deploy to Azure**" button at the bottom and it will bring you to the custom deployment template.

Expand All @@ -219,9 +219,9 @@ In the **Instance Details** section:

* **Function App Name**: Enter the name of your Azure Function App noted in [Deploy the Azure Function App](https://github.com/Accelerynt-Security/AS-Block-GitHub-User#deploy-the-azure-function-app)

* **Key Vault Name**: Enter the name of the Key Vault referenced in [Create an Azure Key Vault Secret](https://Google.com/Accelerynt-Security/AS-Sign-Out-Google-User#create-an-azure-key-vault-secret).
* **Key Vault Name**: Enter the name of the Key Vault referenced in [Create an Azure Key Vault Secret](https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/AS-Sign-Out-Google-User#create-an-azure-key-vault-secret).

* **Secret Name**: Enter the name of the Key Vault Secret created in [Create an Azure Key Vault Secret](https://Google.com/Accelerynt-Security/AS-Sign-Out-Google-User#create-an-azure-key-vault-secret).
* **Secret Name**: Enter the name of the Key Vault Secret created in [Create an Azure Key Vault Secret](https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/AS-Sign-Out-Google-User#create-an-azure-key-vault-secret).

Towards the bottom, click on "**Review + create**".

Expand Down Expand Up @@ -296,4 +296,4 @@ As part of maintaining a robust and secure application, it's essential to regula

As a general guideline, you should review and test for updates at least once per month. More frequent checks can be performed if your function has higher security requirements or is particularly sensitive to bugs in the underlying packages. Automated tools exist to help manage these updates.

You can update the dependent libraries for your Azure Function in VS Code by executing the commands "**pip3 install --upgrade azure-functions**", "**pip3 install --upgrade cryptography**" and "**pip3 install --upgrade pyjwt**" within your "**CreateGoogleJWT**" project directory in the integrated terminal. Redeploy the Function to Azure afterwards.
You can update the dependent libraries for your Azure Function in VS Code by executing the commands "**pip3 install --upgrade azure-functions**", "**pip3 install --upgrade cryptography**" and "**pip3 install --upgrade pyjwt**" within your "**CreateGoogleJWT**" project directory in the integrated terminal. Redeploy the Function to Azure afterwards.
File renamed without changes.

0 comments on commit 6c62458

Please sign in to comment.