...
Microsoft Azure Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution.
Connect Azure Sentinel with Devo SOAR
- Navigate to Automations > Integrations.
- Search for Azure Sentinel.
- Click Details, then the + icon. Enter the required information in the following fields.
- Label: Enter a connection name.
- Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.
- Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).
- Remote Agent: Run this integration using the Devo SOAR Remote Agent.
- Tenant ID: Tenant/directory ID for Azure Sentinel.
- Client ID: Client id for Azure Sentinel.
- Client Secret: Client secret for Azure Sentinel.
- After you've entered all the details, click Connect.
Actions for Azure Sentinel
Execute Query
Executes an analytics query for data.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Workspace Id | Column name from the parent table that contains the ID of the workspace. | Required |
Query | Column name from the parent table that contains the query to execute. Example: Usage | take 10. | Required |
Start Date | Column name from the parent table that contains start date. Example: YYYY-MM-DD (default is last 30 Days). | Optional |
End Date | Column name from the parent table that contains end date. Example: YYYY-MM-DD (default is the last 30 days). | Optional |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
- result: Query Result
List Alert Rules
List alert rules.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Subscription ID | Jinja-templated text containing the subscription ID for azure sentinel | Optional |
Resource Group Name | Jinja-templated text containing the resource group name for azure sentinel | Optional |
Workspace | Jinja-templated text containing the workspace for azure sentinel | Optional |
API Version | Jinja-templated text containing the API version for azure sentinel (Default is '2021-10-01') | Optional |
Output
JSON containing the following items:
...
Code Block |
---|
## Get Alert Rule Get alert rule by its ID. ### Input Field Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection. | Input Name | Description | Required | | :------------------ | :----------------------------------------------------------------------------------------------------------------- | :------- | | Alert Rule ID | [Jinja-templated](doc:jinja-template) text containing the alert rule ID for azure sentinel | Required | | Subscription ID | [Jinja-templated](doc:jinja-template) text containing the subscription ID for azure sentinel | Optional | | Resource Group Name | [Jinja-templated](doc:jinja-template) text containing the resource group name for azure sentinel | Optional | | Workspace | [Jinja-templated](doc:jinja-template) text containing the workspace for azure sentinel | Optional | | API Version | [Jinja-templated](doc:jinja-template) text containing the API version for azure sentinel (Default is '2021-10-01') | Optional | ### Output JSON containing the following items: ``` {json}{ "id": "/subscriptions/44a1188f-486a-40f3-b7b6-5asdfasd1d5b/resourceGroups/iation/providers/Microsoft.OperationalInsights/workspaces/tenteg/providers/Microsoft.SecurityInsights/alertRules/BuiltInFusion", "name": "BuiltInFusion", "etag": "\"25001913-0000-0100-0000-6asdfsad0000\"", "type": "Microsoft.SecurityInsights/alertRules", "kind": "MicrosoftSecurityIncidentCreation", "properties": { "productFilter": "Microsoft Cloud App Security", "severitiesFilter": null, "displayNamesFilter": null, "displayNamesExcludeFilter": null, "displayName": "testing displayname", "enabled": true, "description": null, "alertRuleTemplateName": null, "lastModifiedUtc": "2022-07-07T10:26:30.0222996Z" }, "error": null, "has_error": false } |
Delete Alert Rule
Delete alert rule by its ID.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Alert Rule ID | Jinja-templated text containing the alert rule ID for azure sentinel | Required |
Subscription ID | Jinja-templated text containing the subscription ID for azure sentinel | Optional |
Resource Group Name | Jinja-templated text containing the resource group name for azure sentinel | Optional |
Workspace | Jinja-templated text containing the workspace for azure sentinel | Optional |
API Version | Jinja-templated text containing the API version for azure sentinel (Default is '2021-10-01') | Optional |
Output
JSON containing the following items:
...
Code Block |
---|
## Create or Update Alert Rule Create or update alert rule by its ID. ### Input Field Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection. | Input Name | Description | Required | | :------------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :------- | | Alert Rule ID | [Jinja-templated](doc:jinja-template) text containing the alert rule ID for azure sentinel | Required | | Alert Rule Object | [Jinja-templated](doc:jinja-template) text containing the alert rule object for azure sentinel. Example '{"kind": "Fusion","properties.alertRuleTemplateName": "f7asdfd-2ffb-45tb-b102-4asdf015c8","properties.enabled": true}' | Required | | Subscription ID | [Jinja-templated](doc:jinja-template) text containing the subscription ID for azure sentinel | Optional | | Resource Group Name | [Jinja-templated](doc:jinja-template) text containing the resource group name for azure sentinel | Optional | | Workspace | [Jinja-templated](doc:jinja-template) text containing the workspace for azure sentinel | Optional | | API Version | [Jinja-templated](doc:jinja-template) text containing the API version for azure sentinel (Default is '2021-10-01') | Optional | ### Output JSON containing the following items: ``` {json}{ "id": "/subscriptions/44a1188f-486a-40f3-b7b6-5asdfasd1d5b/resourceGroups/iation/providers/Microsoft.OperationalInsights/workspaces/tenteg/providers/Microsoft.SecurityInsights/alertRules/BuiltInFusion", "name": "BuiltInFusion", "etag": "\"25001913-0000-0100-0000-6asdfsad0000\"", "type": "Microsoft.SecurityInsights/alertRules", "kind": "MicrosoftSecurityIncidentCreation", "properties": { "productFilter": "Microsoft Cloud App Security", "severitiesFilter": null, "displayNamesFilter": null, "displayNamesExcludeFilter": null, "displayName": "testing displayname", "enabled": true, "description": null, "alertRuleTemplateName": null, "lastModifiedUtc": "2022-07-07T10:26:30.0222996Z" }, "error": null, "has_error": false } |
List Actions
List actions by alert rule ID.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Alert Rule ID | Jinja-templated text containing the alert rule ID for azure sentinel | Required |
Subscription ID | Jinja-templated text containing the subscription ID for azure sentinel | Optional |
Resource Group Name | Jinja-templated text containing the resource group name for azure sentinel | Optional |
Workspace | Jinja-templated text containing the workspace for azure sentinel | Optional |
API Version | Jinja-templated text containing the API version for azure sentinel (Default is '2021-10-01') | Optional |
Output
JSON containing the following items:
...
Code Block |
---|
## Get Action Get action by its ID. ### Input Field Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection. | Input Name | Description | Required | | :------------------ | :----------------------------------------------------------------------------------------------------------------- | :------- | | Alert Rule ID | [Jinja-templated](doc:jinja-template) text containing the alert rule ID for azure sentinel | Required | | Action ID | [Jinja-templated](doc:jinja-template) text containing the action ID for azure sentinel | Required | | Subscription ID | [Jinja-templated](doc:jinja-template) text containing the subscription ID for azure sentinel | Optional | | Resource Group Name | [Jinja-templated](doc:jinja-template) text containing the resource group name for azure sentinel | Optional | | Workspace | [Jinja-templated](doc:jinja-template) text containing the workspace for azure sentinel | Optional | | API Version | [Jinja-templated](doc:jinja-template) text containing the API version for azure sentinel (Default is '2021-10-01') | Optional | ### Output JSON containing the following items: ``` {json}{ "value":{ "id": "/subscriptions/44a1188f-486a-40f3-b7b6-5asdf1d5b/resourceGroups/integn/providers/Microsoft.OperationalInsights/workspaces/teteg/providers/Microsoft.SecurityInsights/alertRules/asicustomalertsv3_builtinfusiontest_ij_newaction_ij/actions/newAction_IJ", "name": "newAction_IJ", "etag": "\"a70255cc-0000-0300-0000-62c000\"", "type": "Microsoft.SecurityInsights/alertRules/actions", "properties": { "workflowId": "cd3765391efd4854asd1d48d7", "logicAppResourceId": "/subscriptions/44a1188f-486a-40f3-b7b6-asdfc911d5b/resourceGroups/inttion/providers/Microsoft.Logic/workflows/MyAlerts" } }, "error": null, "has_error": false } |
Delete Action
Delete action by its ID.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Alert Rule ID | Jinja-templated text containing the alert rule ID for azure sentinel | Required |
Action ID | Jinja-templated text containing the action ID for azure sentinel | Required |
Subscription ID | Jinja-templated text containing the subscription ID for azure sentinel | Optional |
Resource Group Name | Jinja-templated text containing the resource group name for azure sentinel | Optional |
Workspace | Jinja-templated text containing the workspace for azure sentinel | Optional |
API Version | Jinja-templated text containing the API version for azure sentinel (Default is '2021-10-01') | Optional |
Output
JSON containing the following items:
...
Code Block |
---|
## Create or Update Action Create or update action. ### Input Field Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection. | Input Name | Description | Required | | :------------------ | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------- | | Alert Rule ID | [Jinja-templated](doc:jinja-template) text containing the alert rule ID for azure sentinel | Required | | Action ID | [Jinja-templated](doc:jinja-template) text containing the action ID for azure sentinel | Required | | Action Object | [Jinja-templated](doc:jinja-template) text containing the action object for azure sentinel. Example '{"kind": "Fusion","properties.alertRuleTemplateName": "f7asdfd-2ffb-45tb-b102-4asdf015c8","properties.enabled": true}' | Required | | Subscription ID | [Jinja-templated](doc:jinja-template) text containing the subscription ID for azure sentinel | Optional | | Resource Group Name | [Jinja-templated](doc:jinja-template) text containing the resource group name for azure sentinel | Optional | | Workspace | [Jinja-templated](doc:jinja-template) text containing the workspace for azure sentinel | Optional | | API Version | [Jinja-templated](doc:jinja-template) text containing the API version for azure sentinel (Default is '2021-10-01') | Optional | ### Output JSON containing the following items: ``` {json}{ "value":{ "id": "/subscriptions/44a1188f-486a-40f3-b7b6-5asdf1d5b/resourceGroups/integn/providers/Microsoft.OperationalInsights/workspaces/teteg/providers/Microsoft.SecurityInsights/alertRules/asicustomalertsv3_builtinfusiontest_ij_newaction_ij/actions/newAction_IJ", "name": "newAction_IJ", "etag": "\"a70255cc-0000-0300-0000-62c000\"", "type": "Microsoft.SecurityInsights/alertRules/actions", "properties": { "workflowId": "cd3765391efd4854asd1d48d7", "logicAppResourceId": "/subscriptions/44a1188f-486a-40f3-b7b6-asdfc911d5b/resourceGroups/inttion/providers/Microsoft.Logic/workflows/MyAlerts" } }, "error": null, "has_error": false } |
List Alert Rule Templates
List alert rule templates.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Subscription ID | Jinja-templated text containing the subscription ID for azure sentinel | Optional |
Resource Group Name | Jinja-templated text containing the resource group name for azure sentinel | Optional |
Workspace | Jinja-templated text containing the workspace for azure sentinel | Optional |
API Version | Jinja-templated text containing the API version for azure sentinel (Default is '2021-10-01') | Optional |
Output
JSON containing the following items:
...
Code Block |
---|
## Get Alert Rule Template Get alert rule template. ### Input Field Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection. | Input Name | Description | Required | | :--------------------- | :----------------------------------------------------------------------------------------------------------------- | :------- | | Alert Rule Template ID | [Jinja-templated](doc:jinja-template) text containing the alert rule template ID for azure sentinel | Required | | Subscription ID | [Jinja-templated](doc:jinja-template) text containing the subscription ID for azure sentinel | Optional | | Resource Group Name | [Jinja-templated](doc:jinja-template) text containing the resource group name for azure sentinel | Optional | | Workspace | [Jinja-templated](doc:jinja-template) text containing the workspace for azure sentinel | Optional | | API Version | [Jinja-templated](doc:jinja-template) text containing the API version for azure sentinel (Default is '2021-10-01') | Optional | ### Output JSON containing the following items: ``` {json}{ "value": { "id": "/subscriptions/44a1188f-486a-40f3-b7b6-5basdfasdfd5b/resourceGroups/intion/providers/Microsoft.OperationalInsights/workspaces/testeg/providers/Microsoft.SecurityInsights/alertRules/BuiltInFusion", "name": "BuiltInFusion", "etag": "\"240035cc-0000-0100-0000-6asdfs950000\"", "type": "Microsoft.SecurityInsights/alertRules", "kind": "Fusion", "properties": { "displayName": "Advanced Multistage Attack Detection", "description": "Microsoft Sentinel uses Fusion, a correlation engine based on scalable machine learning algorithms, to automatically detect multistage attacks by identifying combinations of anomalous behaviors and suspicious activities that are observed at various stages of the kill chain. On the basis of these discoveries, Azure Sentinel generates incidents that would otherwise be very difficult to catch. By design, these incidents are low-volume, high-fidelity, and high-severity, which is why this detection is turned ON by default.\n\nSince Fusion correlates multiple signals from various products to detect advanced multistage attacks, successful Fusion detections are presented as Fusion incidents on the Microsoft Sentinel Incidents page. This rule covers the following detections:\n- Fusion for emerging threats\n- Fusion for ransomware\n- Scenario-based Fusion detections (122 scenarios)\n\nTo enable these detections, we recommend you configure the following data connectors for best results:\n- Out-of-the-box anomaly detections\n- Azure Active Directory Identity Protection\n- Azure Defender\n- Azure Defender for IoT\n- Microsoft 365 Defender\n- Microsoft Cloud App Security \n- Microsoft Defender for Endpoint\n- Microsoft Defender for Identity\n- Microsoft Defender for Office 365\n- Scheduled analytics rules, both built-in and those created by your security analysts. Analytics rules must contain kill-chain (tactics) and entity mapping information in order to be used by Fusion.\n\nFor the full description of each detection that is supported by Fusion, go to https://aka.ms/SentinelFusion.", "alertRuleTemplateName": "f71aba3d-28fb-450b-b192-4easdf015c8", "tactics": [ "Collection", "CommandAndControl", "PrivilegeEscalation" ], "severity": "High", "enabled": true, "lastModifiedUtc": "2022-07-07T04:35:33.2698249Z" } } "error": null, "has_error": false } |
List Automation Rules
List automation rules.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Subscription ID | Jinja-templated text containing the subscription ID for azure sentinel | Optional |
Resource Group Name | Jinja-templated text containing the resource group name for azure sentinel | Optional |
Workspace | Jinja-templated text containing the workspace for azure sentinel | Optional |
API Version | Jinja-templated text containing the API version for azure sentinel (Default is '2021-10-01') | Optional |
Output
JSON containing the following items:
...
Code Block |
---|
## Get Automation Rule Get automation rule by its ID. ### Input Field Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection. | Input Name | Description | Required | | :------------------ | :----------------------------------------------------------------------------------------------------------------- | :------- | | Automation Rule ID | [Jinja-templated](doc:jinja-template) text containing the automation rule ID for azure sentinel | Required | | Subscription ID | [Jinja-templated](doc:jinja-template) text containing the subscription ID for azure sentinel | Optional | | Resource Group Name | [Jinja-templated](doc:jinja-template) text containing the resource group name for azure sentinel | Optional | | Workspace | [Jinja-templated](doc:jinja-template) text containing the workspace for azure sentinel | Optional | | API Version | [Jinja-templated](doc:jinja-template) text containing the API version for azure sentinel (Default is '2021-10-01') | Optional | ### Output JSON containing the following items: ``` {json}{ "value":{ "id": "/subscriptions/44a1188f-486a-40f3-b7b6-5basdfd5b/resourceGroups/intion/providers/Microsoft.OperationalInsights/workspaces/teseg/providers/Microsoft.SecurityInsights/AutomationRules/testij", "name": "testij", "etag": "\"1f005462-0000-0100-0000-62c7asdf00\"", "type": "Microsoft.SecurityInsights/AutomationRules", "properties": { "displayName": "hello IJ", "order": 1, "triggeringLogic": { "isEnabled": true, "triggersOn": "Incidents", "triggersWhen": "Created", "conditions": [] }, "actions": [ { "order": 1, "actionType": "ModifyProperties", "actionConfiguration": { "severity": "High", "status": null, "classification": null, "classificationReason": null, "classificationComment": null, "owner": null, "labels": null } } ], "lastModifiedTimeUtc": "2022-07-08T04:34:20Z", "createdTimeUtc": "2022-07-08T04:34:20Z", "lastModifiedBy": { "objectId": "8792fc6e-1ddd-407f-b522-8basdf68ff", "email": null, "name": "External application - Sentinel", "userPrincipalName": null }, "createdBy": { "objectId": "8792fc6e-1ddd-407f-b522-8basdfc68ff", "email": null, "name": "External application - Sentinel", "userPrincipalName": null } } }, "error": null, "has_error": false } |
Delete Automation Rule
Delete automation rule by its ID.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Automation Rule ID | Jinja-templated text containing the automation rule ID for azure sentinel | Required |
Subscription ID | Jinja-templated text containing the subscription ID for azure sentinel | Optional |
Resource Group Name | Jinja-templated text containing the resource group name for azure sentinel | Optional |
Workspace | Jinja-templated text containing the workspace for azure sentinel | Optional |
API Version | Jinja-templated text containing the API version for azure sentinel (Default is '2021-10-01') | Optional |
Output
JSON containing the following items:
...
Code Block |
---|
## Create or Update Automation Rule Create or update automation rule. ### Input Field Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection. | Input Name | Description | Required | | :--------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :------- | | Automation Rule ID | [Jinja-templated](doc:jinja-template) text containing the automation rule ID for azure sentinel | Required | | Automation Rule Object | [Jinja-templated](doc:jinja-template) text containing the automation object for azure sentinel. Example '{"kind": "Fusion","properties.alertRuleTemplateName": "f7asdfd-2ffb-45tb-b102-4asdf015c8","properties.enabled": true}' | Required | | Subscription ID | [Jinja-templated](doc:jinja-template) text containing the subscription ID for azure sentinel | Optional | | Resource Group Name | [Jinja-templated](doc:jinja-template) text containing the resource group name for azure sentinel | Optional | | Workspace | [Jinja-templated](doc:jinja-template) text containing the workspace for azure sentinel | Optional | | API Version | [Jinja-templated](doc:jinja-template) text containing the API version for azure sentinel (Default is '2021-10-01') | Optional | ### Output JSON containing the following items: ``` {json}{ "value":{ "id": "/subscriptions/44a1188f-486a-40f3-b7b6-5basdfd5b/resourceGroups/intion/providers/Microsoft.OperationalInsights/workspaces/teseg/providers/Microsoft.SecurityInsights/AutomationRules/testij", "name": "testij", "etag": "\"1f005462-0000-0100-0000-62c7asdf00\"", "type": "Microsoft.SecurityInsights/AutomationRules", "properties": { "displayName": "hello IJ", "order": 1, "triggeringLogic": { "isEnabled": true, "triggersOn": "Incidents", "triggersWhen": "Created", "conditions": [] }, "actions": [ { "order": 1, "actionType": "ModifyProperties", "actionConfiguration": { "severity": "High", "status": null, "classification": null, "classificationReason": null, "classificationComment": null, "owner": null, "labels": null } } ], "lastModifiedTimeUtc": "2022-07-08T04:34:20Z", "createdTimeUtc": "2022-07-08T04:34:20Z", "lastModifiedBy": { "objectId": "8792fc6e-1ddd-407f-b522-8basdf68ff", "email": null, "name": "External application - Sentinel", "userPrincipalName": null }, "createdBy": { "objectId": "8792fc6e-1ddd-407f-b522-8basdfc68ff", "email": null, "name": "External application - Sentinel", "userPrincipalName": null } } }, "error": null, "has_error": false } |
List Bookmarks
List bookmarks.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Subscription ID | Jinja-template text containing the subscription ID for azure sentinel | Optional |
Resource Group Name | Jinja-template text containing the resource group name for azure sentinel | Optional |
Workspace | Jinja-template text containing the workspace for azure sentinel | Optional |
API Version | Jinja-template text containing the API version for azure sentinel (Default is '2021-10-01') | Optional |
Output
JSON containing the following items:
...
Code Block |
---|
## Get Bookmark Get Bookmark by its ID. ### Input Field Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection. | Input Name | Description | Required | | :------------------ | :---------------------------------------------------------------------------------------------------------------- | :------- | | Bookmark ID | [Jinja-template](doc:jinja-template) text containing the bookmark ID for azure sentinel | Required | | Subscription ID | [Jinja-template](doc:jinja-template) text containing the subscription ID for azure sentinel | Optional | | Resource Group Name | [Jinja-template](doc:jinja-template) text containing the resource group name for azure sentinel | Optional | | Workspace | [Jinja-template](doc:jinja-template) text containing the workspace for azure sentinel | Optional | | API Version | [Jinja-template](doc:jinja-template) text containing the API version for azure sentinel (Default is '2021-10-01') | Optional | ### Output JSON containing the following items: ``` {json}{ "value": { "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/73e01a99-5cd7-4139-a149-9f2736ff2ab5", "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5", "type": "Microsoft.SecurityInsights/bookmarks", "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"", "properties": { "displayName": "My bookmark", "createdBy": { "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70", "email": "john@contoso.com", "name": "john doe" }, "updatedBy": { "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70", "email": "john@contoso.com", "name": "john doe" }, "updated": "2021-09-01T13:15:30Z", "created": "2021-09-01T13:15:30Z", "notes": "Found a suspicious activity", "labels": [ "Tag1", "Tag2" ], "query": "SecurityEvent | where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)", "queryResult": "Security Event query result", "incidentInfo": { "incidentId": "DDA55F97-170B-40B9-B8ED-CBFD05481E7D", "severity": "Low", "title": "New case 1", "relationName": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0018" }, "tactics": [ "Execution" ], "techniques": [ "T1609" ], "entityMappings": [ { "entityType": "Account", "fieldMappings": [ { "identifier": "Fullname", "value": "johndoe@microsoft.com" } ] } ] } }, "has_error": false, "error": null } |
Delete Bookmark
Delete bookmark by its ID.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Bookmark ID | Jinja-template text containing the bookmark ID for azure sentinel | Required |
Subscription ID | Jinja-template text containing the subscription ID for azure sentinel | Optional |
Resource Group Name | Jinja-template text containing the resource group name for azure sentinel | Optional |
Workspace | Jinja-template text containing the workspace for azure sentinel | Optional |
API Version | Jinja-template text containing the API version for azure sentinel (Default is '2021-10-01') | Optional |
Output
JSON containing the following items:
...
Code Block |
---|
## Create or Update Bookmark Create or update bookmark. ### Input Field Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection. | Input Name | Description | Required | | :------------------ | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------- | | Bookmark ID | [Jinja-template](doc:jinja-template) text containing the bookmark ID for azure sentinel | Required | | Bookmark Object | [Jinja-template](doc:jinja-template) text containing the bookmark object for azure sentinel. Example '{"kind": "Fusion","properties.alertRuleTemplateName": "f7asdfd-2ffb-45tb-b102-4asdf015c8","properties.enabled": true}' | Required | | Subscription ID | [Jinja-template](doc:jinja-template) text containing the subscription ID for azure sentinel | Optional | | Resource Group Name | [Jinja-template](doc:jinja-template) text containing the resource group name for azure sentinel | Optional | | Workspace | [Jinja-template](doc:jinja-template) text containing the workspace for azure sentinel | Optional | | API Version | [Jinja-template](doc:jinja-template) text containing the API version for azure sentinel (Default is '2021-10-01') | Optional | ### Output JSON containing the following items: ``` {json}{ "value":{ "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/73e01a99-5cd7-4139-a149-9f2736ff2ab5", "name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5", "type": "Microsoft.SecurityInsights/bookmarks", "etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"", "properties": { "displayName": "My bookmark", "createdBy": { "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70", "email": "john@contoso.com", "name": "john doe" }, "updatedBy": { "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70", "email": "john@contoso.com", "name": "john doe" }, "updated": "2021-09-01T13:15:30Z", "created": "2021-09-01T13:15:30Z", "notes": "Found a suspicious activity", "labels": [ "Tag1", "Tag2" ], "query": "SecurityEvent | where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)", "queryResult": "Security Event query result", "tactics": [ "Execution" ], "techniques": [ "T1609" ], "entityMappings": [ { "entityType": "Account", "fieldMappings": [ { "identifier": "Fullname", "value": "johndoe@microsoft.com" } ] } ] } }, "has_error": false, "error": null } |
List Data Connectors
List data connectors.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Subscription ID | Jinja-template text containing the subscription ID for azure sentinel | Optional |
Resource Group Name | Jinja-template text containing the resource group name for azure sentinel | Optional |
Workspace | Jinja-template text containing the workspace for azure sentinel | Optional |
API Version | Jinja-template text containing the API version for azure sentinel (Default is '2021-10-01') | Optional |
Output
JSON containing the following items:
...
Code Block |
---|
## Get Data Connector Get Data Connector by its ID. ### Input Field Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection. | Input Name | Description | Required | | :------------------ | :---------------------------------------------------------------------------------------------------------------- | :------- | | Data Connector ID | [Jinja-template](doc:jinja-template) text containing the data connector ID for azure sentinel | Required | | Subscription ID | [Jinja-template](doc:jinja-template) text containing the subscription ID for azure sentinel | Optional | | Resource Group Name | [Jinja-template](doc:jinja-template) text containing the resource group name for azure sentinel | Optional | | Workspace | [Jinja-template](doc:jinja-template) text containing the workspace for azure sentinel | Optional | | API Version | [Jinja-template](doc:jinja-template) text containing the API version for azure sentinel (Default is '2021-10-01') | Optional | ### Output JSON containing the following items: ``` {json}{ "value": { "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/316ec55e-7138-4d63-ab18-90c8a60fd1c8", "name": "316ec55e-7138-4d63-ab18-90c8a60fd1c8", "etag": "\"1a00b074-0000-0100-0000-606ef5bd0000\"", "type": "Microsoft.SecurityInsights/dataConnectors", "kind": "APIPolling", "properties": { "connectorUiConfig": { "title": "GitHub Enterprise Audit Log", "publisher": "GitHub", "descriptionMarkdown": "The GitHub audit log connector provides the capability to ingest GitHub logs into Azure Sentinel. By connecting GitHub audit logs into Azure Sentinel, you can view this data in workbooks, use it to create custom alerts, and improve your investigation process.", "customImage": "The image connector content", "graphQueriesTableName": "GitHubAuditLogPolling_CL", "graphQueries": [ { "metricName": "Total events received", "legend": "GitHub audit log events", "baseQuery": "{{graphQueriesTableName}}" } ], "sampleQueries": [ { "description": "All logs", "query": "{{graphQueriesTableName}}\n | take 10 <change>" } ], "dataTypes": [ { "name": "{{graphQueriesTableName}}", "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } ], "connectivityCriteria": [ { "type": "SentinelKindsV2", "value": [] } ], "availability": { "status": 1, "isPreview": true }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "read and write permissions are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "write": true, "read": true, "delete": true } } ], "customs": [ { "name": "GitHub API personal token Key", "description": "You need access to GitHub personal token, the key should have 'admin:org' scope" } ] }, "instructionSteps": [ { "title": "Connect GitHub Enterprise Audit Log to Azure Sentinel", "description": "Enable GitHub audit Logs. \n Follow [this](https://docs.github.com/en/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token) to create or find your personal key", "instructions": [ { "parameters": { "enable": "true", "userRequestPlaceHoldersInput": [ { "displayText": "Organization Name", "requestObjectKey": "apiEndpoint", "placeHolderName": "{{placeHolder1}}", "placeHolderValue": "" } ] }, "type": "APIKey" } ] } ] }, "pollingConfig": { "auth": { "authType": "APIKey", "apiKeyIdentifier": "token", "apiKeyName": "Authorization" }, "request": { "apiEndpoint": "https://api.github.com/organizations/{{placeHolder1}}/audit-log", "rateLimitQps": 50, "queryWindowInMin": 15, "httpMethod": "Get", "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", "retryCount": 2, "timeoutInSeconds": 60, "headers": { "Accept": "application/json", "User-Agent": "Scuba" }, "queryParameters": { "phrase": "created:{_QueryWindowStartTime}..{_QueryWindowEndTime}" } }, "paging": { "pagingType": "LinkHeader", "pageSizeParaName": "per_page" }, "response": { "eventsJsonPaths": [ "$" ] } } } }, "has_error": false, "error": null } |
Delete Data Connector
Delete data connector by its ID.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Data Connector ID | Jinja-template text containing the data connector ID for azure sentinel | Required |
Subscription ID | Jinja-template text containing the subscription ID for azure sentinel | Optional |
Resource Group Name | Jinja-template text containing the resource group name for azure sentinel | Optional |
Workspace | Jinja-template text containing the workspace for azure sentinel | Optional |
API Version | Jinja-template text containing the API version for azure sentinel (Default is '2021-10-01') | Optional |
Output
JSON containing the following items:
...
Code Block |
---|
## Create or Update Data Connector Create or update data connector. ### Input Field Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection. | Input Name | Description | Required | | :-------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------- | | Data Connector ID | [Jinja-template](doc:jinja-template) text containing the data connector ID for azure sentinel | Required | | Data Connector Object | [Jinja-template](doc:jinja-template) text containing the bookmark object for azure sentinel. Example '{"kind": "Fusion","properties.alertRuleTemplateName": "f7asdfd-2ffb-45tb-b102-4asdf015c8","properties.enabled": true}' | Required | | Subscription ID | [Jinja-template](doc:jinja-template) text containing the subscription ID for azure sentinel | Optional | | Resource Group Name | [Jinja-template](doc:jinja-template) text containing the resource group name for azure sentinel | Optional | | Workspace | [Jinja-template](doc:jinja-template) text containing the workspace for azure sentinel | Optional | | API Version | [Jinja-template](doc:jinja-template) text containing the API version for azure sentinel (Default is '2021-10-01') | Optional | ### Output JSON containing the following items: ``` {json}{ "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/dataConnectors/316ec55e-7138-4d63-ab18-90c8a60fd1c8", "name": "316ec55e-7138-4d63-ab18-90c8a60fd1c8", "etag": "\"1a00b074-0000-0100-0000-606ef5bd0000\"", "type": "Microsoft.SecurityInsights/dataConnectors", "kind": "APIPolling", "properties": { "connectorUiConfig": { "title": "GitHub Enterprise Audit Log", "publisher": "GitHub", "descriptionMarkdown": "The GitHub audit log connector provides the capability to ingest GitHub logs into Azure Sentinel. By connecting GitHub audit logs into Azure Sentinel, you can view this data in workbooks, use it to create custom alerts, and improve your investigation process.", "graphQueriesTableName": "GitHubAuditLogPolling_CL", "graphQueries": [ { "metricName": "Total events received", "legend": "GitHub audit log events", "baseQuery": "{{graphQueriesTableName}}" } ], "sampleQueries": [ { "description": "All logs", "query": "{{graphQueriesTableName}}\n | take 10 <change>" } ], "dataTypes": [ { "name": "{{graphQueriesTableName}}", "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } ], "connectivityCriteria": [ { "type": "SentinelKindsV2", "value": [] } ], "availability": { "status": 1, "isPreview": true }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "read and write permissions are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "write": true, "read": true, "delete": true } } ], "customs": [ { "name": "GitHub API personal token Key", "description": "You need access to GitHub personal token, the key should have 'admin:org' scope" } ] }, "instructionSteps": [ { "title": "Connect GitHub Enterprise Audit Log to Azure Sentinel", "description": "Enable GitHub audit Logs. \n Follow [this](https://docs.github.com/en/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token) to create or find your personal key", "instructions": [ { "parameters": { "enable": "true", "userRequestPlaceHoldersInput": [ { "displayText": "Organization Name", "requestObjectKey": "apiEndpoint", "placeHolderName": "{{placeHolder1}}", "placeHolderValue": "" } ] }, "type": "APIKey" } ] } ] }, "pollingConfig": { "auth": { "authType": "APIKey", "apiKeyIdentifier": "token", "apiKeyName": "Authorization" }, "request": { "apiEndpoint": "https://api.github.com/organizations/{{placeHolder1}}/audit-log", "rateLimitQps": 50, "queryWindowInMin": 15, "httpMethod": "Get", "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", "retryCount": 2, "timeoutInSeconds": 60, "headers": { "Accept": "application/json", "User-Agent": "Scuba" }, "queryParameters": { "phrase": "created:{_QueryWindowStartTime}..{_QueryWindowEndTime}" } }, "paging": { "pagingType": "LinkHeader", "pageSizeParaName": "per_page" }, "response": { "eventsJsonPaths": [ "$" ] } }, "has_error": false, "error": null } |
List Incidents
List incidents.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Filter | Jinja-template JSON containing the filter for azure sentinel. Example '{"filter":"{{filter}}","$orderby":"{{orderby}}","$top":"{{top}}"}' | Optional |
Limit | Jinja-template JSON containing the limit for azure sentinel. (Default is 10000) | Optional |
Subscription ID | Jinja-template text containing the subscription ID for azure sentinel | Optional |
Resource Group Name | Jinja-template text containing the resource group name for azure sentinel | Optional |
Workspace | Jinja-template text containing the workspace for azure sentinel | Optional |
API Version | Jinja-template text containing the API version for azure sentinel (Default is '2021-10-01') | Optional |
Output
JSON containing the following items:
...
Code Block |
---|
## List Incident Alerts List incident alerts. ### Input Field Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection. | Input Name | Description | Required | | :------------------ | :---------------------------------------------------------------------------------------------------------------- | :------- | | Incident ID | [Jinja-template](doc:jinja-template) text containing the incident ID for azure sentinel. | Required | | Subscription ID | [Jinja-template](doc:jinja-template) text containing the subscription ID for azure sentinel | Optional | | Resource Group Name | [Jinja-template](doc:jinja-template) text containing the resource group name for azure sentinel | Optional | | Workspace | [Jinja-template](doc:jinja-template) text containing the workspace for azure sentinel | Optional | | API Version | [Jinja-template](doc:jinja-template) text containing the API version for azure sentinel (Default is '2021-10-01') | Optional | ### Output JSON containing the following items: ``` {json}{ "value": [ { "id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/myRG/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/Entities/baa8a239-6fde-4ab7-a093-d09f7b75c58c", "name": "baa8a239-6fde-4ab7-a093-d09f7b75c58c", "type": "Microsoft.SecurityInsights/Entities", "kind": "SecurityAlert", "properties": { "systemAlertId": "baa8a239-6fde-4ab7-a093-d09f7b75c58c", "tactics": [], "alertDisplayName": "myAlert", "confidenceLevel": "Unknown", "severity": "Low", "vendorName": "Microsoft", "productName": "Azure Security Center", "alertType": "myAlert", "processingEndTime": "2020-07-20T18:21:53.6158361Z", "status": "New", "endTimeUtc": "2020-07-20T18:21:53.6158361Z", "startTimeUtc": "2020-07-20T18:21:53.6158361Z", "timeGenerated": "2020-07-20T18:21:53.6158361Z", "resourceIdentifiers": [ { "type": "LogAnalytics", "workspaceId": "c8c99641-985d-4e4e-8e91-fb3466cd0e5b", "subscriptionId": "bd794837-4d29-4647-9105-6339bfdb4e6a", "resourceGroup": "myRG" } ], "additionalData": { "AlertMessageEnqueueTime": "2020-07-20T18:21:57.304Z" }, "friendlyName": "myAlert" } } ], "has_error": false, "error": null } |
List Incident Bookmarks
List incident bookmarks.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Incident ID | Jinja-template text containing the incident ID for azure sentinel. | Required |
Subscription ID | Jinja-template text containing the subscription ID for azure sentinel | Optional |
Resource Group Name | Jinja-template text containing the resource group name for azure sentinel | Optional |
Workspace | Jinja-template text containing the workspace for azure sentinel | Optional |
API Version | Jinja-template text containing the API version for azure sentinel (Default is '2021-10-01') | Optional |
Output
JSON containing the following items:
...
Code Block |
---|
## List Incident Entities List incident entities. ### Input Field Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection. | Input Name | Description | Required | | :------------------ | :---------------------------------------------------------------------------------------------------------------- | :------- | | Incident ID | [Jinja-template](doc:jinja-template) text containing the incident ID for azure sentinel. | Required | | Subscription ID | [Jinja-template](doc:jinja-template) text containing the subscription ID for azure sentinel | Optional | | Resource Group Name | [Jinja-template](doc:jinja-template) text containing the resource group name for azure sentinel | Optional | | Workspace | [Jinja-template](doc:jinja-template) text containing the workspace for azure sentinel | Optional | | API Version | [Jinja-template](doc:jinja-template) text containing the API version for azure sentinel (Default is '2021-10-01') | Optional | ### Output JSON containing the following items: ``` {json}{ "entities": [ { "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/Entities/e1d3d618-e11f-478b-98e3-bb381539a8e1", "name": "e1d3d618-e11f-478b-98e3-bb381539a8e1", "type": "Microsoft.SecurityInsights/Entities", "kind": "Account", "properties": { "friendlyName": "administrator", "accountName": "administrator", "ntDomain": "domain" } } ], "metaData": [ { "entityKind": "Account", "count": 1 } ], "has_error": false, "error": null } |
Get Incident
Get incident by its ID.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Incident ID | Jinja-template text containing the incident ID for azure sentinel. | Required |
Subscription ID | Jinja-template text containing the subscription ID for azure sentinel | Optional |
Resource Group Name | Jinja-template text containing the resource group name for azure sentinel | Optional |
Workspace | Jinja-template text containing the workspace for azure sentinel | Optional |
API Version | Jinja-template text containing the API version for azure sentinel (Default is '2021-10-01') | Optional |
Output
JSON containing the following items:
...
Code Block |
---|
## Delete Incident Delete incident by its ID. ### Input Field Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection. | Input Name | Description | Required | | :------------------ | :---------------------------------------------------------------------------------------------------------------- | :------- | | Incident ID | [Jinja-template](doc:jinja-template) text containing the incident ID for azure sentinel. | Required | | Subscription ID | [Jinja-template](doc:jinja-template) text containing the subscription ID for azure sentinel | Optional | | Resource Group Name | [Jinja-template](doc:jinja-template) text containing the resource group name for azure sentinel | Optional | | Workspace | [Jinja-template](doc:jinja-template) text containing the workspace for azure sentinel | Optional | | API Version | [Jinja-template](doc:jinja-template) text containing the API version for azure sentinel (Default is '2021-10-01') | Optional | ### Output JSON containing the following items: ``` {json}{ "message": "Deleted Successfully.", "has_error": false, "error": null } |
Create or Update Incident
Create or update incident.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Incident ID | Jinja-template text containing the incident ID for azure sentinel | Required |
Incident Object | Jinja-template text containing the incident object for azure sentinel. Example '{"kind": "Fusion","properties.alertRuleTemplateName": "f7asdfd-2ffb-45tb-b102-4asdf015c8","properties.enabled": true}' | Required |
Subscription ID | Jinja-template text containing the subscription ID for azure sentinel | Optional |
Resource Group Name | Jinja-template text containing the resource group name for azure sentinel | Optional |
Workspace | Jinja-template text containing the workspace for azure sentinel | Optional |
API Version | Jinja-template text containing the API version for azure sentinel (Default is '2021-10-01') | Optional |
Output
JSON containing the following items:
...
Code Block |
---|
## Get Incident Comments Gets a comment for a given incident. ### Input Field Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection. | Input Name | Description | Required | | :------------------ | :----------------------------------------------------------------------------------------------------------------- | :------- | | Incident Comment Id | [Jinja-templated](doc:jinja-template) text containing the incident comment Id. | Required | | Incident Id | [Jinja-templated](doc:jinja-template) text containing the incident Id. | Required | | Subscription ID | [Jinja-templated](doc:jinja-template) text containing the subscription ID for azure sentinel | Optional | | Resource Group Name | [Jinja-templated](doc:jinja-template) text containing the resource group name for azure sentinel | Optional | | Workspace | [Jinja-templated](doc:jinja-template) text containing the workspace for azure sentinel | Optional | | Api Version | [Jinja-templated](doc:jinja-template) text containing the API version for azure sentinel (Default is '2021-10-01') | Optional | ### Output JSON containing the following items: ``` {json}{ "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ab5/comments/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014", "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014", "etag": "\"190057d0-0000-0d00-0000-5c6f5adb0000\"", "type": "Microsoft.SecurityInsights/incidents/comments", "properties": { "message": "Some message", "createdTimeUtc": "2019-01-01T13:15:30Z", "lastModifiedTimeUtc": "2019-01-03T11:10:30Z", "author": { "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70", "email": "john.doe@contoso.com", "name": "john doe", "userPrincipalName": "john@contoso.com" } }, "has_error": false, "error": null } |
List Incident Comments
Gets all comments for a given incident.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Incident Id | Jinja-templated text containing the incident Id. | Required |
Subscription ID | Jinja-templated text containing the subscription ID for azure sentinel | Optional |
Resource Group Name | Jinja-templated text containing the resource group name for azure sentinel | Optional |
Workspace | Jinja-templated text containing the workspace for azure sentinel | Optional |
Api Version | Jinja-templated text containing the API version for azure sentinel (Default is '2021-10-01') | Optional |
Output
JSON containing the following items:
...
Code Block |
---|
## Delete Incident Comments Deletes a comment for a given incident. ### Input Field Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection. | Input Name | Description | Required | | :------------------ | :----------------------------------------------------------------------------------------------------------------- | :------- | | Incident Comment Id | [Jinja-templated](doc:jinja-template) text containing the incident comment Id. | Required | | Incident Id | [Jinja-templated](doc:jinja-template) text containing the incident Id. | Required | | Subscription ID | [Jinja-templated](doc:jinja-template) text containing the subscription ID for azure sentinel | Optional | | Resource Group Name | [Jinja-templated](doc:jinja-template) text containing the resource group name for azure sentinel | Optional | | Workspace | [Jinja-templated](doc:jinja-template) text containing the workspace for azure sentinel | Optional | | Api Version | [Jinja-templated](doc:jinja-template) text containing the API version for azure sentinel (Default is '2021-10-01') | Optional | ### Output JSON containing the following items: ``` {json}{ "msg": "Successfully deleted.", "has_error": false, "error": null } |
Create Or Update Incident Comments
Creates or updates a comment for a given incident.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Incident Comment Id | Jinja-templated text containing the incident comment Id. | Required |
Incident Id | Jinja-templated text containing the incident Id. | Required |
Incident Comment Object | Jinja-templated JSON containing the incident comment object for azure sentinel. Example '{"properties": {"message": "Some message"}}' | Required |
Subscription ID | Jinja-templated text containing the subscription ID for azure sentinel | Optional |
Resource Group Name | Jinja-templated text containing the resource group name for azure sentinel | Optional |
Workspace | Jinja-templated text containing the workspace for azure sentinel | Optional |
Api Version | Jinja-templated text containing the API version for azure sentinel (Default is '2021-10-01') | Optional |
Output
JSON containing the following items:
...
Code Block |
---|
## Get Incident Relations Gets a relation for a given incident. ### Input Field Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection. | Input Name | Description | Required | | :------------------ | :----------------------------------------------------------------------------------------------------------------- | :------- | | Relation Name | [Jinja-templated](doc:jinja-template) text containing the relation name. | Required | | Incident Id | [Jinja-templated](doc:jinja-template) text containing the incident Id. | Required | | Subscription ID | [Jinja-templated](doc:jinja-template) text containing the subscription ID for azure sentinel | Optional | | Resource Group Name | [Jinja-templated](doc:jinja-template) text containing the resource group name for azure sentinel | Optional | | Workspace | [Jinja-templated](doc:jinja-template) text containing the workspace for azure sentinel | Optional | | Api Version | [Jinja-templated](doc:jinja-template) text containing the API version for azure sentinel (Default is '2021-10-01') | Optional | ### Output JSON containing the following items: ``` {json}{ "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/afbd324f-6c48-459c-8710-8d1e1cd03812/relations/4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014", "name": "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014", "type": "Microsoft.SecurityInsights/incidents/relations", "etag": "190057d0-0000-0d00-0000-5c6f5adb0000", "properties": { "relatedResourceId": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalIinsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/2216d0e1-91e3-4902-89fd-d2df8c535096", "relatedResourceName": "2216d0e1-91e3-4902-89fd-d2df8c535096", "relatedResourceType": "Microsoft.SecurityInsights/bookmarks" }, "has_error": false, "error": null } |
List Incident Relations
Gets all relations for a given incident.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Incident Id | Jinja-templated text containing the incident Id. | Required |
Subscription ID | Jinja-templated text containing the subscription ID for azure sentinel | Optional |
Resource Group Name | Jinja-templated text containing the resource group name for azure sentinel | Optional |
Workspace | Jinja-templated text containing the workspace for azure sentinel | Optional |
Api Version | Jinja-templated text containing the API version for azure sentinel (Default is '2021-10-01') | Optional |
Output
JSON containing the following items:
...
Code Block |
---|
## Delete Incident Relations Deletes a relation for a given incident. ### Input Field Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection. | Input Name | Description | Required | | :------------------ | :----------------------------------------------------------------------------------------------------------------- | :------- | | Relation Name | [Jinja-templated](doc:jinja-template) text containing the relation name. | Required | | Incident Id | [Jinja-templated](doc:jinja-template) text containing the incident Id. | Required | | Subscription ID | [Jinja-templated](doc:jinja-template) text containing the subscription ID for azure sentinel | Optional | | Resource Group Name | [Jinja-templated](doc:jinja-template) text containing the resource group name for azure sentinel | Optional | | Workspace | [Jinja-templated](doc:jinja-template) text containing the workspace for azure sentinel | Optional | | Api Version | [Jinja-templated](doc:jinja-template) text containing the API version for azure sentinel (Default is '2021-10-01') | Optional | ### Output JSON containing the following items: ``` {json}{ "msg": "Successfully deleted.", "has_error": false, "error": null } |
Create Or Update Incident Relations
Creates or updates a relation for a given incident.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Relation Name | Jinja-templated text containing the relation name. | Required |
Incident Id | Jinja-templated text containing the incident Id. | Required |
Incident Relation Object | Jinja-templated JSON containing the incident comment object for azure sentinel. Example '{"properties": {"relatedResourceId": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/bookmarks/2216d0e1-91e3-4902-89fd-d2df8c535096"}}' | Required |
Subscription ID | Jinja-templated text containing the subscription ID for azure sentinel | Optional |
Resource Group Name | Jinja-templated text containing the resource group name for azure sentinel | Optional |
Workspace | Jinja-templated text containing the workspace for azure sentinel | Optional |
Api Version | Jinja-templated text containing the API version for azure sentinel (Default is '2021-10-01') | Optional |
Output
JSON containing the following items:
...
Code Block |
---|
## List Watchlist Items Get all watchlist items by watchlist alias. ### Input Field Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection. | Input Name | Description | Required | | :------------------ | :----------------------------------------------------------------------------------------------------------------- | :------- | | Watchlist Alias | [Jinja-templated](doc:jinja-template) text containing the watchlist alias for azure sentinel | Required | | Subscription Id | [Jinja-templated](doc:jinja-template) text containing the subscription Id for azure sentinel | Optional | | Resource Group Name | [Jinja-templated](doc:jinja-template) text containing the resource group name for azure sentinel | Optional | | Workspace | [Jinja-templated](doc:jinja-template) text containing the workspace for azure sentinel | Optional | | API Version | [Jinja-templated](doc:jinja-template) text containing the API version for azure sentinel (Default is '2022-11-01') | Optional | ### Output JSON containing the following items: ``` {json}{ "value":[ { "id":"/subscriptions/74e2fd3f-10a9-415c-8989-f76f58ea418d/resourceGroups/test-integ/providers/Microsoft.OperationalInsights/workspaces/test-integ/providers/Microsoft.SecurityInsights/Watchlists/highValueAsset/WatchlistItems/a26d3a54-d84c-4dcb-85a8-796493f9ad86", "name":"a26d3a54-d84c-4dcb-85a8-796493f9ad86", "etag":"\"5800ec71-0000-0100-0000-641812ce0000\"", "type":"Microsoft.SecurityInsights/Watchlists/WatchlistItems", "systemData":{ "createdAt":"2023-03-20T08:01:17.0907117Z", "createdBy":"f7be553d-2bc7-4211-be04-7859b9fd150d", "createdByType":"Application", "lastModifiedAt":"2023-03-20T08:01:17.0907117Z", "lastModifiedBy":"f7be553d-2bc7-4211-be04-7859b9fd150d", "lastModifiedByType":"Application" }, "properties":{ "watchlistItemType":"watchlist-item", "watchlistItemId":"a26d3a54-d84c-4dcb-85a8-796493f9ad86", "tenantId":"80a36173-9e4c-47ae-b5ae-4d5fd8f4b657", "isDeleted":false, "created":"2023-03-20T08:01:17.0907117+00:00", "updated":"2023-03-20T08:01:17.0907117+00:00", "createdBy":{ "objectId":"7aec28d0-7341-4efa-8147-6293798dc9d2", "name":"f7be553d-2bc7-4211-be04-7859b9fd150d" }, "updatedBy":{ "objectId":"7aec28d0-7341-4efa-8147-6293798dc9d2", "name":"f7be553d-2bc7-4211-be04-7859b9fd150d" }, "itemsKeyValue":{ "header1":"value1", "header2":"value2" }, "entityMapping":{ } } } ], "error":null, "has_error":false } |
Get Watchlist Item
Get watchlist item by its Id.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Watchlist Alias | Jinja-templated text containing the watchlist alias for azure sentinel | Required |
Watchlist Item Id | Jinja-templated text containing the watchlist item Id for azure sentinel | Required |
Subscription Id | Jinja-templated text containing the subscription Id for azure sentinel | Optional |
Resource Group Name | Jinja-templated text containing the resource group name for azure sentinel | Optional |
Workspace | Jinja-templated text containing the workspace for azure sentinel | Optional |
API Version | Jinja-templated text containing the API version for azure sentinel (Default is '2022-11-01') | Optional |
Output
JSON containing the following items:
...
Code Block |
---|
## Delete Watchlist Item Delete watchlist item by its Id. ### Input Field Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection. | Input Name | Description | Required | | :------------------ | :----------------------------------------------------------------------------------------------------------------- | :------- | | Watchlist Alias | [Jinja-templated](doc:jinja-template) text containing the watchlist alias for azure sentinel | Required | | Watchlist Item Id | [Jinja-templated](doc:jinja-template) text containing the watchlist item Id for azure sentinel | Required | | Subscription ID | [Jinja-templated](doc:jinja-template) text containing the subscription ID for azure sentinel | Optional | | Resource Group Name | [Jinja-templated](doc:jinja-template) text containing the resource group name for azure sentinel | Optional | | Workspace | [Jinja-templated](doc:jinja-template) text containing the workspace for azure sentinel | Optional | | API Version | [Jinja-templated](doc:jinja-template) text containing the API version for azure sentinel (Default is '2022-11-01') | Optional | ### Output JSON containing the following items: ``` {json}{ "msg": "Successfully deleted.", "has_error": false, "error": null } |
Create or Update Watchlist Item
Create or update watchlist_item.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Watchlist Alias | Jinja-templated text containing the watchlist alias for azure sentinel | Required |
Watchlist Item Id | Jinja-templated text containing the watchlist item Id for azure sentinel | Required |
Action Object | Jinja-templated text containing the action object for azure sentinel. Example '{"etag": "0300bf09-0000-0000-0000-5c37296e0000", "properties": { "itemsKeyValue": { "Gateway subnet": "10.0.255.224/27", "Web Tier": "10.0.1.0/24", "Business tier": "10.0.2.0/24", "Data tier": "10.0.2.0/24", "Private DMZ in": "10.0.0.0/27", "Public DMZ out": "10.0.0.96/27"}}}' | Required |
Subscription ID | Jinja-templated text containing the subscription ID for azure sentinel | Optional |
Resource Group Name | Jinja-templated text containing the resource group name for azure sentinel | Optional |
Workspace | Jinja-templated text containing the workspace for azure sentinel | Optional |
API Version | Jinja-templated text containing the API version for azure sentinel (Default is '2022-11-01') | Optional |
Output
JSON containing the following items:
...
Code Block |
---|
## List Watchlist Get all watchlist. ### Input Field Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection. | Input Name | Description | Required | | :------------------ | :----------------------------------------------------------------------------------------------------------------- | :------- | | Subscription Id | [Jinja-templated](doc:jinja-template) text containing the subscription Id for azure sentinel | Optional | | Resource Group Name | [Jinja-templated](doc:jinja-template) text containing the resource group name for azure sentinel | Optional | | Workspace | [Jinja-templated](doc:jinja-template) text containing the workspace for azure sentinel | Optional | | API Version | [Jinja-templated](doc:jinja-template) text containing the API version for azure sentinel (Default is '2022-11-01') | Optional | ### Output JSON containing the following items: ``` {json}{ "value":[ { "id":"/subscriptions/74e2fd3f-10a9-415c-8989-f76f58ea418d/resourceGroups/test-integ/providers/Microsoft.OperationalInsights/workspaces/test-integ/providers/Microsoft.SecurityInsights/Watchlists/highValueAsset", "name":"highValueAsset", "type":"Microsoft.SecurityInsights/Watchlists", "systemData":{ "createdAt":"2023-03-20T08:01:17.0907117Z", "createdBy":"f7be553d-2bc7-4211-be04-7859b9fd150d", "createdByType":"Application", "lastModifiedAt":"2023-03-20T08:01:17.0907117Z", "lastModifiedBy":"f7be553d-2bc7-4211-be04-7859b9fd150d", "lastModifiedByType":"Application" }, "properties":{ "watchlistId":"39cb57cf-37ef-480c-b6a7-2318bd14c659", "displayName":"High Value Assets Watchlist", "provider":"Microsoft", "source":"Local file", "itemsSearchKey":"header1", "created":"2023-03-20T08:01:17.0907117+00:00", "updated":"2023-03-20T08:01:17.0907117+00:00", "createdBy":{ "objectId":"7aec28d0-7341-4efa-8147-6293798dc9d2", "name":"f7be553d-2bc7-4211-be04-7859b9fd150d" }, "updatedBy":{ "objectId":"7aec28d0-7341-4efa-8147-6293798dc9d2", "name":"f7be553d-2bc7-4211-be04-7859b9fd150d" }, "description":"Watchlist from CSV content", "watchlistType":"watchlist", "watchlistAlias":"highValueAsset", "isDeleted":false, "labels":[ ], "tenantId":"80a36173-9e4c-47ae-b5ae-4d5fd8f4b657", "numberOfLinesToSkip":0, "uploadStatus":"Complete" } }, { "id":"/subscriptions/74e2fd3f-10a9-415c-8989-f76f58ea418d/resourceGroups/test-integ/providers/Microsoft.OperationalInsights/workspaces/test-integ/providers/Microsoft.SecurityInsights/Watchlists/testAsset", "name":"testAsset", "type":"Microsoft.SecurityInsights/Watchlists", "systemData":{ "createdAt":"2023-03-20T08:56:01.879566Z", "createdBy":"f7be553d-2bc7-4211-be04-7859b9fd150d", "createdByType":"Application", "lastModifiedAt":"2023-03-20T08:56:01.879566Z", "lastModifiedBy":"f7be553d-2bc7-4211-be04-7859b9fd150d", "lastModifiedByType":"Application" }, "properties":{ "watchlistId":"4e3ff120-f6aa-4d51-baa2-47c17fdcac12", "displayName":"High Value Assets Watchlist", "provider":"Microsoft", "source":"Local file", "itemsSearchKey":"header1", "created":"2023-03-20T08:56:01.879566+00:00", "updated":"2023-03-20T08:56:01.879566+00:00", "createdBy":{ "objectId":"7aec28d0-7341-4efa-8147-6293798dc9d2", "name":"f7be553d-2bc7-4211-be04-7859b9fd150d" }, "updatedBy":{ "objectId":"7aec28d0-7341-4efa-8147-6293798dc9d2", "name":"f7be553d-2bc7-4211-be04-7859b9fd150d" }, "description":"Watchlist from CSV content", "watchlistType":"watchlist", "watchlistAlias":"testAsset", "isDeleted":false, "labels":[ ], "tenantId":"80a36173-9e4c-47ae-b5ae-4d5fd8f4b657", "numberOfLinesToSkip":0, "uploadStatus":"Complete" } } ], "error":null, "has_error":false } |
Batch Query
Executes a batch of Analytics queries for data.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required | ||
---|---|---|---|---|
Body | Jinja-templated JSON containing the batch query data for azure sentinel. Example '{"requests": [{"id": "1","body": {"query": "AppRequests | take 2"},"path": "/query","method": "POST","workspace": "d2d0e126-fa1e-4b0a-b647-250cdd471e68"},{"id": "2","body": {"query": "AppRequests | take 3"},"path": "/query","method": "POST","workspace": "d2d0e126-fa1e-4b0a-b647-250cdd471e68"}]}' | Required |
Output
JSON containing the following items:
...
} }, { "id":"2", "status":403, "body":{ "error":{ "message":"The provided authentication is not valid for this resource", "code":"InvalidTokenError", "correlationId":"aa169800-6742-4c12-a7ea-78e332d30e16", "innererror":{ "code":"InvalidAuthenticationTokenTenant", "message":"The access token is from the wrong issuer." } } } } ], "error":null, "has_error":false } ```
Release Notes
v2.2.11
- Added limit result optional field inList Incidents
action.v2.2.1
- Added debug logs inExecute Query
action.v2.2.0
- AddedBatch Query
action.v2.1.1
- UpdatedQuery
action: Theapi.loganalytics.io
endpoint is being replaced byapi.loganalytics.azure.com
.v2.1.0
- Added 5 new actions:List Watchlist Items
,Get Watchlist Item
,Delete Watchlist Item
,Create or Update Watchlist Item
andList Watchlist
.v2.0.0
- Updated architecture to support IO via filesystemv1.3.3
- Added 8 new actions:Create Or Update Incident Relations
,Delete Incident Relations
,List Incident Relations
,Get Incident Relations
,Create Or Update Incident Comments
,Delete Incident Comments
,List Incident Comments
andGet Incident Comments
.v1.2.1
- Added 15 new actions:Create or Update Bookmark
,Create or Update Data Connector
,Create or Update Incident
,DELETE Bookmark
,DELETE Data Connector
,Delete Incident
,Get Bookmark
,Get Data Connector
,Get Incident
,List Bookmarks
,List Data Connector
,List Incident Alerts
,List Bookmarks
,List Incident Entities
andList Incidents
.v1.1.9
- Bug fix forExecute query
action throwing error when there are double quotes in the query.v1.1.4
- Added 14 new actions -List Alert Rules
,Get Alert Rule
,Delete Alert Rule
,Create Or Update Alert Rule
,List Actions
,Get Action
,Delete Action
,Create Or Update Action
,List Alert Rule Templates
,Get Alert Rule Template
,List Automation Rules
,Get Automation Rules
,Delete Automation Rule
andCreate Or Update Automation Rule
...