Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updating the original playbook #7906

Closed
wants to merge 8 commits into from
Closed

Updating the original playbook #7906

Changes from 3 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
88d3068
Updating the original playbook
noapocalypse Apr 24, 2023
cd48a7d
Update azuredeploy.json
noapocalypse Apr 26, 2023
7ef8d25
Update azuredeploy.json
noapocalypse Apr 26, 2023
c98dc0e
Update azuredeploy.json
noapocalypse May 2, 2023
b2c5c30
Merge branch 'Azure:master' into patch-1
noapocalypse Jun 6, 2023
a2b7213
Update azuredeploy.json
noapocalypse Jun 19, 2023
e1de03f
Update azuredeploy.json
noapocalypse Jun 20, 2023
a29407f
Update azuredeploy.json
noapocalypse Jun 20, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
142 changes: 68 additions & 74 deletions Playbooks/Enrich-SentinelIncident-MDATPTVM/azuredeploy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,43 +1,25 @@
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"metadata":{
"comments": "This playbook will enrich the Client machine that is part of sentinel incident with thread vulnerabilities data (TVM) with CVE that their score is grater then 7.5. Also it automatically add this information to the incident as comments and change the incident severity to High.",
"author": "Yaniv Shasha"
},
"parameters": {
"PlaybookName": {
"defaultValue": "Enrich-SentinelIncident-MDATPTVM",
"type": "String"
}
},
"variables": {
"AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]"
},
"variables": {},
"resources": [
{
"type": "Microsoft.Web/connections",
"apiVersion": "2016-06-01",
"name": "[variables('AzureSentinelConnectionName')]",
"location": "[resourceGroup().location]",
"properties": {
"customParameterValues": {},
"api": {
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
}
}
},
{
"type": "Microsoft.Logic/workflows",
"apiVersion": "2017-07-01",
"name": "[parameters('PlaybookName')]",
noapocalypse marked this conversation as resolved.
Show resolved Hide resolved
"location": "[resourceGroup().location]",
"location": "westeurope",
noapocalypse marked this conversation as resolved.
Show resolved Hide resolved
"tags": {
"LogicAppsCategory": "security"
},
"dependsOn": [
"[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]"
],
"identity": {
"type": "SystemAssigned"
},
"properties": {
"state": "Enabled",
"definition": {
Expand All @@ -50,7 +32,7 @@
}
},
"triggers": {
"Microsoft_Sentinel_alert": {
"Microsoft_Sentinel_incident": {
"type": "ApiConnectionWebhook",
"inputs": {
"body": {
Expand All @@ -61,78 +43,66 @@
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
}
},
"path": "/subscribe"
"path": "/incident-creation"
}
}
},
"actions": {
"Alert_-_Get_hosts": {
"runAfter": {
"Alert_-_Get_incident": [
"Succeeded"
]
},
"runAfter": {},
"type": "ApiConnection",
"inputs": {
"body": "@triggerBody()?['Entities']",
"body": "@triggerBody()?['object']?['properties']?['relatedEntities']",
"host": {
"connection": {
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
"name": "@parameters('$connections')['azuresentinel_3']['connectionId']"
}
},
"method": "post",
"path": "/entities/host"
}
},
"Alert_-_Get_incident": {
"runAfter": {},
"type": "ApiConnection",
"inputs": {
"host": {
"connection": {
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
}
},
"method": "get",
"path": "/Cases/@{encodeURIComponent(triggerBody()?['SystemAlertId'])}/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}"
}
},
"For_each_2": {
"foreach": "@body('Alert_-_Get_hosts')?['Hosts']",
"actions": {
"Condition_2": {
"actions": {
"Add_comment_to_incident_(V2)": {
"Add_comment_to_incident_(V3)": {
"runAfter": {},
"type": "ApiConnection",
"inputs": {
"body": {
"Value": "We found list of CVE's for Host @{items('For_each_2')?['HostName']}\n @{variables('CVE''s')}"
"incidentArmId": "@triggerBody()?['object']?['id']",
"message": "<p>We found list of CVE's for Host @{items('For_each_2')?['HostName']}<br>\n @{variables('CVE''s')}</p>"
},
"host": {
"connection": {
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
}
},
"method": "put",
"path": "/Comment/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/@{encodeURIComponent('Incident')}/@{encodeURIComponent(body('Alert_-_Get_incident')?['properties']?['CaseNumber'])}"
"method": "post",
"path": "/Incidents/Comment"
}
},
"Change_incident_severity_to_High": {
"Update_incident": {
"runAfter": {
"Add_comment_to_incident_(V2)": [
"Add_comment_to_incident_(V3)": [
"Succeeded"
]
},
"type": "ApiConnection",
"inputs": {
"body": {
"incidentArmId": "@triggerBody()?['object']?['id']",
"severity": "High"
},
"host": {
"connection": {
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
}
},
"method": "put",
"path": "/Case/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/@{encodeURIComponent('Incident')}/@{encodeURIComponent(body('Alert_-_Get_incident')?['properties']?['CaseNumber'])}/Severity/@{encodeURIComponent('High')}"
"path": "/Incidents"
}
}
},
Expand Down Expand Up @@ -206,7 +176,7 @@
"type": "ActiveDirectoryOAuth"
},
"method": "GET",
"uri": "https://api.securitycenter.windows.com/api/machines/@{body('Parse_JSON')['MachineId']}/vulnerabilities"
"uri": "https://api.securitycenter.windows.com/api/machines/@{body('Parse_JSON')?['additionalData']?['MdatpDeviceId']}/vulnerabilities"
}
},
"Parse_JSON": {
Expand All @@ -216,37 +186,60 @@
"content": "@items('For_each_2')",
"schema": {
"properties": {
"$id": {
"Type": {
"type": "string"
},
"DnsDomain": {
"type": "string"
"additionalData": {
"properties": {
"AvStatus": {
"type": "string"
},
"FQDN": {
"type": "string"
},
"HealthStatus": {
"type": "string"
},
"LastExternalIpAddress": {
"type": "string"
},
"LastIpAddress": {
"type": "string"
},
"LastSeen": {
"type": "string"
},
"LoggedOnUsers": {
"type": "string"
},
"MdatpDeviceId": {
"type": "string"
},
"OnboardingStatus": {
"type": "string"
},
"RiskScore": {
"type": "string"
}
},
"type": "object"
},
"HostName": {
"dnsDomain": {
"type": "string"
},
"IsDomainJoined": {
"type": "boolean"
"friendlyName": {
"type": "string"
},
"MachineId": {
"hostName": {
"type": "string"
},
"MachineIdType": {
"type": "integer"
"osFamily": {
"type": "string"
},
"Type": {
"osVersion": {
"type": "string"
}
},
"required": [
"$id",
"DnsDomain",
"HostName",
"IsDomainJoined",
"Type",
"MachineId",
"MachineIdType"
],
"type": "object"
}
}
Expand Down Expand Up @@ -367,11 +360,12 @@
"connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]",
"connectionName": "[variables('AzureSentinelConnectionName')]",
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"

}
}
}
}
}
}
]
}
}