Sentinel to MS Sentinel

Azure · Nov 2, 2023 · aa08134 · aa08134
1 parent fce8ca2
commit aa08134
Show file tree

Hide file tree

Showing 4 changed files with 6 additions and 6 deletions.
diff --git a/Solutions/MicrosoftDefenderForEndpoint/Package/mainTemplate.json b/Solutions/MicrosoftDefenderForEndpoint/Package/mainTemplate.json
@@ -5910,7 +5910,7 @@
                         "body": {
                           "action": "AlertAndBlock",
                           "application": "Microsoft Sentinel",
-                          "description": "This block command has been made through the Restrict-MDEDomain-entityTrigger. Ran on URL Entity from Sentinel Incident with ARM ID: @{triggerBody()?['IncidentArmID']}. Entity properties: @{triggerBody()?['Entity']?['properties']}",
+                          "description": "This block command has been made through the Restrict-MDEDomain-entityTrigger. Ran on URL Entity from Microsoft Sentinel Incident with ARM ID: @{triggerBody()?['IncidentArmID']}. Entity properties: @{triggerBody()?['Entity']?['properties']}",
                           "expirationTime": "@{addDays(utcNow(), 90)}",
                           "indicatorType": "DomainName",
                           "indicatorValue": "@{triggerBody()?['Entity']?['properties']?['DomainName']}",
@@ -6420,7 +6420,7 @@
                         "body": {
                           "action": "AlertAndBlock",
                           "application": "Microsoft Sentinel",
-                          "description": "IP blocked by Restrict-MDEIP-entityTrigger Logic app from an entity in Sentinel Incident (ARM ID): @{triggerBody()?['IncidentArmID']}. Properties: @{triggerBody()?['Entity']?['properties']}",
+                          "description": "IP blocked by Restrict-MDEIP-entityTrigger Logic app from an entity in Microsoft Sentinel Incident (ARM ID): @{triggerBody()?['IncidentArmID']}. Properties: @{triggerBody()?['Entity']?['properties']}",
                           "expirationTime": "@{addDays(utcNow(), 90)}",
                           "indicatorType": "IpAddress",
                           "indicatorValue": "@{triggerBody()?['Entity']?['properties']?['Address']}",
@@ -6647,7 +6647,7 @@
                         "body": {
                           "action": "AlertAndBlock",
                           "application": "Microsoft Sentinel",
-                          "description": "This block command has been made through the Restrict-MDEUrl-entityTrigger. Ran on URL Entity from Sentinel Incident with ARM ID: @{triggerBody()?['IncidentArmID']}. Entity properties: @{triggerBody()?['Entity']?['properties']}",
+                          "description": "This block command has been made through the Restrict-MDEUrl-entityTrigger. Ran on URL Entity from Microsoft Sentinel Incident with ARM ID: @{triggerBody()?['IncidentArmID']}. Entity properties: @{triggerBody()?['Entity']?['properties']}",
                           "expirationTime": "@{addDays(utcNow(), 90)}",
                           "indicatorType": "Url",
                           "indicatorValue": "@{triggerBody()?['Entity']?['properties']?['Url']}",

diff --git a/...rEndpoint/Playbooks/Restrict-MDEDomain/Restrict-MDEDomain-entity-trigger/azuredeploy.json b/...rEndpoint/Playbooks/Restrict-MDEDomain/Restrict-MDEDomain-entity-trigger/azuredeploy.json
@@ -115,7 +115,7 @@
                                 "body": {
                                     "action": "AlertAndBlock",
                                     "application": "Microsoft Sentinel",
-                                    "description": "This block command has been made through the Restrict-MDEDomain-entityTrigger. Ran on URL Entity from Sentinel Incident with ARM ID: @{triggerBody()?['IncidentArmID']}. Entity properties: @{triggerBody()?['Entity']?['properties']}",
+                                    "description": "This block command has been made through the Restrict-MDEDomain-entityTrigger. Ran on URL Entity from Microsoft Sentinel Incident with ARM ID: @{triggerBody()?['IncidentArmID']}. Entity properties: @{triggerBody()?['Entity']?['properties']}",
                                     "expirationTime": "@{addDays(utcNow(), 90)}",
                                     "indicatorType": "DomainName",
                                     "indicatorValue": "@{triggerBody()?['Entity']?['properties']?['DomainName']}",

diff --git a/...int/Playbooks/Restrict-MDEIPAddress/Restrict-MDEIPAddress-entity-trigger/azuredeploy.json b/...int/Playbooks/Restrict-MDEIPAddress/Restrict-MDEIPAddress-entity-trigger/azuredeploy.json
@@ -112,7 +112,7 @@
                                 "body": {
                                     "action": "AlertAndBlock",
                                     "application": "Microsoft Sentinel",
-                                    "description": "IP blocked by Restrict-MDEIP-entityTrigger Logic app from an entity in Sentinel Incident (ARM ID): @{triggerBody()?['IncidentArmID']}. Properties: @{triggerBody()?['Entity']?['properties']}",
+                                    "description": "IP blocked by Restrict-MDEIP-entityTrigger Logic app from an entity in Microsoft Sentinel Incident (ARM ID): @{triggerBody()?['IncidentArmID']}. Properties: @{triggerBody()?['Entity']?['properties']}",
                                     "expirationTime": "@{addDays(utcNow(), 90)}",
                                     "indicatorType": "IpAddress",
                                     "indicatorValue": "@{triggerBody()?['Entity']?['properties']?['Address']}",

diff --git a/...nderForEndpoint/Playbooks/Restrict-MDEUrl/Restrict-MDEUrl-entity-trigger/azuredeploy.json b/...nderForEndpoint/Playbooks/Restrict-MDEUrl/Restrict-MDEUrl-entity-trigger/azuredeploy.json
@@ -115,7 +115,7 @@
                                 "body": {
                                     "action": "AlertAndBlock",
                                     "application": "Microsoft Sentinel",
-                                    "description": "This block command has been made through the Restrict-MDEUrl-entityTrigger. Ran on URL Entity from Sentinel Incident with ARM ID: @{triggerBody()?['IncidentArmID']}. Entity properties: @{triggerBody()?['Entity']?['properties']}",
+                                    "description": "This block command has been made through the Restrict-MDEUrl-entityTrigger. Ran on URL Entity from Microsoft Sentinel Incident with ARM ID: @{triggerBody()?['IncidentArmID']}. Entity properties: @{triggerBody()?['Entity']?['properties']}",
                                     "expirationTime": "@{addDays(utcNow(), 90)}",
                                     "indicatorType": "Url",
                                     "indicatorValue": "@{triggerBody()?['Entity']?['properties']?['Url']}",