Skip to content

Commit 7cf800b

Browse files
ErikMangstenRecFutErikMangstenRecFut
committed
fix: check if table exists to facilitate analytic rule
1 parent e3e182b commit 7cf800b

File tree

1 file changed

+81
-3
lines changed
  • Solutions/Recorded Future Identity/Playbooks/RFI-Playbook-Alert-Importer-LAW

1 file changed

+81
-3
lines changed

‎Solutions/Recorded Future Identity/Playbooks/RFI-Playbook-Alert-Importer-LAW/azuredeploy.json‎

Lines changed: 81 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,12 @@
8080
"description": "Required. The name of the Log Analytics Workspace table where Playbook Alerts should be saved."
8181
},
8282
"type": "String"
83+
},
84+
"log_analytics_workspace_name": {
85+
"metadata": {
86+
"description": "Required. The name of the Log Analytics Workspace to query for existing tables."
87+
},
88+
"type": "String"
8389
}
8490
},
8591
"resources": [
@@ -89,7 +95,8 @@
8995
"[resourceId('Microsoft.Web/connections', variables('Rfi-Customconnector-0-2-0ConnectionName'))]",
9096
"[resourceId('Microsoft.Web/connections', variables('AzureadConnectionName'))]",
9197
"[resourceId('Microsoft.Web/connections', variables('AzureadipConnectionName'))]",
92-
"[resourceId('Microsoft.Web/connections', variables('AzureloganalyticsdatacollectorConnectionName'))]"
98+
"[resourceId('Microsoft.Web/connections', variables('AzureloganalyticsdatacollectorConnectionName'))]",
99+
"[resourceId('Microsoft.Web/connections', variables('AzuremonitorlogsConnectionName'))]"
93100
],
94101
"identity": {
95102
"type": "SystemAssigned"
@@ -388,8 +395,59 @@
388395
"method": "post",
389396
"path": "/playbook-alerts/search"
390397
},
391-
"runAfter": {},
392-
"type": "ApiConnection"
398+
"runAfter": {
399+
"Create_table_if_missing": [
400+
"Succeeded",
401+
"Skipped"
402+
],
403+
"Check_if_table_exists": [
404+
"Succeeded"
405+
]
406+
}
407+
},
408+
"Check_if_table_exists": {
409+
"type": "ApiConnection",
410+
"inputs": {
411+
"host": {
412+
"connection": {
413+
"name": "@parameters('$connections')['azuremonitorlogs']['connectionId']"
414+
}
415+
},
416+
"method": "post",
417+
"body": {
418+
"query": "RecordedFutureIdentity_PlaybookAlertResults_CL | take 1",
419+
"timerangetype": "2"
420+
},
421+
"path": "/queryDataV2",
422+
"queries": {
423+
"subscriptions": "[subscription().subscriptionId]",
424+
"resourcegroups": "[resourceGroup().name]",
425+
"resourcetype": "Log Analytics Workspace",
426+
"resourcename": "[parameters('log_analytics_workspace_name')]"
427+
}
428+
},
429+
"runAfter": {}
430+
},
431+
"Create_table_if_missing": {
432+
"type": "ApiConnection",
433+
"inputs": {
434+
"host": {
435+
"connection": {
436+
"name": "@parameters('$connections')['azureloganalyticsdatacollector']['connectionId']"
437+
}
438+
},
439+
"method": "post",
440+
"body": "[\n {\n \"TimeGenerated\": \"2020-01-01T00:00:00.000Z\",\n \"panel_evidence_summary_assessments\": \"TEST_ASSESSMENTS\",\n \"panel_evidence_summary_authorization_url\": \"https://test.example.com/test\",\n \"panel_evidence_summary_compromised_host_antivirus\": \"TEST_ANTIVIRUS\",\n \"panel_evidence_summary_compromised_host_computer_name\": \"TEST_COMPUTER\",\n \"panel_evidence_summary_compromised_host_exfiltration_date\": \"2020-01-01T00:00:00.000Z\",\n \"panel_evidence_summary_compromised_host_malware_file\": \"TEST_MALWARE_FILE\",\n \"panel_evidence_summary_compromised_host_os\": \"TEST_OS\",\n \"panel_evidence_summary_compromised_host_os_username\": \"TEST_USERNAME\",\n \"panel_evidence_summary_compromised_host_timezone\": \"TEST_TIMEZONE\",\n \"panel_evidence_summary_compromised_host_uac\": \"TEST_UAC\",\n \"panel_evidence_summary_dump_description\": \"TEST_DUMP_DESCRIPTION\",\n \"panel_evidence_summary_dump_name\": \"TEST_DUMP_NAME\",\n \"panel_evidence_summary_exposed_secret_details_clear_text_hint\": \"TEST_HINT\",\n \"panel_evidence_summary_exposed_secret_details_properties\": \"TEST_PROPERTIES\",\n \"panel_evidence_summary_exposed_secret_effectively_clear\": false,\n \"panel_evidence_summary_exposed_secret_hashes\": \"TEST_HASHES\",\n \"panel_evidence_summary_exposed_secret_type\": \"TEST_SECRET_TYPE\",\n \"panel_evidence_summary_infrastructure_ip\": \"0.0.0.0\",\n \"panel_evidence_summary_malware_family_id\": \"TEST_MALWARE_ID\",\n \"panel_evidence_summary_malware_family_name\": \"TEST_MALWARE_NAME\",\n \"panel_evidence_summary_subject\": \"TEST_SUBJECT\",\n \"panel_evidence_summary_technologies\": \"TEST_TECHNOLOGIES\",\n \"panel_status_actions_taken\": \"TEST_ACTIONS\",\n \"panel_status_alert_rule_id\": \"TEST_ALERT_RULE_ID\",\n \"panel_status_alert_rule_label\": \"TEST_ALERT_RULE_LABEL\",\n \"panel_status_alert_rule_name\": \"TEST_ALERT_RULE_NAME\",\n \"panel_status_assignee_id\": \"TEST_ASSIGNEE_ID\",\n \"panel_status_assignee_name\": \"TEST_ASSIGNEE_NAME\",\n \"panel_status_case_rule_id\": \"TEST_CASE_RULE_ID\",\n \"panel_status_case_rule_label\": \"TEST_CASE_RULE_LABEL\",\n \"panel_status_created\": \"2020-01-01T00:00:00.000Z\",\n \"panel_status_entity_id\": \"TEST_ENTITY_ID\",\n \"panel_status_entity_name\": \"TEST_ENTITY_NAME\",\n \"panel_status_organisation_id\": \"TEST_ORG_ID\",\n \"panel_status_organisation_name\": \"TEST_ORG_NAME\",\n \"panel_status_owner_id\": \"TEST_OWNER_ID\",\n \"panel_status_owner_name\": \"TEST_OWNER_NAME\",\n \"panel_status_owner_organisation_details_enterprise_id\": \"TEST_ENTERPRISE_ID\",\n \"panel_status_owner_organisation_details_enterprise_name\": \"TEST_ENTERPRISE_NAME\",\n \"panel_status_owner_organisation_details_organisations\": \"TEST_ORGANISATIONS\",\n \"panel_status_priority\": \"TEST_PRIORITY\",\n \"panel_status_reopen\": \"TEST_REOPEN\",\n \"panel_status_status\": \"TEST_STATUS\",\n \"panel_status_targets\": \"TEST_TARGETS\",\n \"panel_status_updated\": \"2020-01-01T00:00:00.000Z\",\n \"playbook_alert_id\": \"TEST_PLAYBOOK_ALERT_ID\",\n \"alert_description\": \"TEST_ALERT_DESCRIPTION\"\n }\n]\n",
441+
"headers": {
442+
"Log-Type": "@parameters('playbook_alert_log_analytics_custom_log_name')"
443+
},
444+
"path": "/api/logs"
445+
},
446+
"runAfter": {
447+
"Check_if_table_exists": [
448+
"Failed"
449+
]
450+
}
393451
}
394452
},
395453
"contentVersion": "1.0.0.0",
@@ -456,6 +514,11 @@
456514
"connectionId": "[resourceId('Microsoft.Web/connections', variables('Rfi-Customconnector-0-2-0ConnectionName'))]",
457515
"connectionName": "[variables('Rfi-Customconnector-0-2-0ConnectionName')]",
458516
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/customApis/', parameters('RFICustomConnector'))]"
517+
},
518+
"azuremonitorlogs": {
519+
"connectionId": "[resourceId('Microsoft.Web/connections', variables('AzuremonitorlogsConnectionName'))]",
520+
"connectionName": "[variables('AzuremonitorlogsConnectionName')]",
521+
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/Azuremonitorlogs')]"
459522
}
460523
}
461524
}
@@ -520,12 +583,27 @@
520583
"displayName": "[variables('AzureloganalyticsdatacollectorConnectionName')]"
521584
},
522585
"type": "Microsoft.Web/connections"
586+
},
587+
{
588+
"apiVersion": "2016-06-01",
589+
"kind": "V1",
590+
"location": "[resourceGroup().location]",
591+
"name": "[variables('AzuremonitorlogsConnectionName')]",
592+
"properties": {
593+
"api": {
594+
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/Azuremonitorlogs')]"
595+
},
596+
"customParameterValues": {},
597+
"displayName": "[variables('AzuremonitorlogsConnectionName')]"
598+
},
599+
"type": "Microsoft.Web/connections"
523600
}
524601
],
525602
"variables": {
526603
"AzureadConnectionName": "[concat('Azuread-', parameters('PlaybookName'))]",
527604
"AzureadipConnectionName": "[concat('Azureadip-', parameters('PlaybookName'))]",
528605
"AzureloganalyticsdatacollectorConnectionName": "[concat('Azureloganalyticsdatacollector-', parameters('PlaybookName'))]",
606+
"AzuremonitorlogsConnectionName": "[concat('Azuremonitorlogs-', parameters('PlaybookName'))]",
529607
"Rfi-Customconnector-0-2-0ConnectionName": "RFI-CustomConnector-0-2-0"
530608
}
531609
}

0 commit comments

Comments
 (0)