|
70 | 70 | "mainTemplate": { |
71 | 71 | "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", |
72 | 72 | "contentVersion": "[variables('playbookVersion1')]", |
73 | | - "metadata": { |
74 | | - "title": "TacitRed Defender TI - Function App", |
75 | | - "description": "This Azure Function App processes TacitRed threat intelligence data and prepares it for ingestion into Microsoft Defender Threat Intelligence via the Upload API.", |
76 | | - "prerequisites": "1. TacitRed API Key (obtain from https://app.tacitred.com)\n2. Microsoft Sentinel workspace with Defender TI integration", |
77 | | - "postDeployment": [ |
78 | | - "1. Note the Function App URL after deployment", |
79 | | - "2. Deploy the TacitRedToDefenderTI Logic App playbook", |
80 | | - "3. Configure the Logic App with the Function App URL and TacitRed API Key" |
81 | | - ], |
82 | | - "prerequisitesDeployTemplateFile": "", |
83 | | - "lastUpdateTime": "2025-12-10T00:00:00.000Z", |
84 | | - "entities": [], |
85 | | - "tags": ["ThreatIntelligence", "DefenderTI", "AzureFunction", "TacitRed"], |
86 | | - "support": { |
87 | | - "tier": "Partner", |
88 | | - "name": "Data443 Risk Mitigation, Inc.", |
89 | | - "email": "support@data443.com", |
90 | | - "link": "https://www.data443.com" |
91 | | - }, |
92 | | - "author": { |
93 | | - "name": "Data443 Risk Mitigation, Inc." |
94 | | - } |
95 | | - }, |
96 | 73 | "parameters": { |
97 | 74 | "FunctionAppName": { |
98 | 75 | "defaultValue": "tacitreddefenderti", |
|
219 | 196 | }, |
220 | 197 | { |
221 | 198 | "name": "SENTINEL_WORKSPACE_ID", |
222 | | - "value": "[[variables('workspaceResourceId')]" |
| 199 | + "value": "[[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]" |
223 | 200 | }, |
224 | 201 | { |
225 | 202 | "name": "APPINSIGHTS_INSTRUMENTATIONKEY", |
|
233 | 210 | "type": "Microsoft.Authorization/roleAssignments", |
234 | 211 | "apiVersion": "2022-04-01", |
235 | 212 | "name": "[[guid(resourceGroup().id, variables('functionAppName'), 'Reader')]", |
236 | | - "scope": "[[variables('workspaceResourceId')]", |
| 213 | + "scope": "[[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", |
237 | 214 | "properties": { |
238 | 215 | "roleDefinitionId": "[[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", |
239 | 216 | "principalId": "[[reference(resourceId('Microsoft.Web/sites', variables('functionAppName')), '2024-04-01', 'Full').identity.principalId]", |
|
247 | 224 | "type": "Microsoft.Authorization/roleAssignments", |
248 | 225 | "apiVersion": "2022-04-01", |
249 | 226 | "name": "[[guid(resourceGroup().id, variables('functionAppName'), 'SentinelContributor')]", |
250 | | - "scope": "[[variables('workspaceResourceId')]", |
| 227 | + "scope": "[[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", |
251 | 228 | "properties": { |
252 | 229 | "roleDefinitionId": "[[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ab8e14d6-4a74-4a29-9ba8-549422addade')]", |
253 | 230 | "principalId": "[[reference(resourceId('Microsoft.Web/sites', variables('functionAppName')), '2024-04-01', 'Full').identity.principalId]", |
|
283 | 260 | } |
284 | 261 | } |
285 | 262 | } |
286 | | - ] |
| 263 | + ], |
| 264 | + "metadata": { |
| 265 | + "title": "TacitRedDefenderTI_FunctionApp", |
| 266 | + "description": "This Azure Function connects to TacitRed API to retrieve compromised credentials and pushes them to Microsoft Defender Threat Intelligence.", |
| 267 | + "prerequisites": [ |
| 268 | + "TacitRed API Key", |
| 269 | + "Microsoft Sentinel workspace with Defender TI enabled" |
| 270 | + ], |
| 271 | + "lastUpdateTime": "2025-12-09T00:00:00Z", |
| 272 | + "tags": [ |
| 273 | + "TacitRed", |
| 274 | + "Threat Intelligence", |
| 275 | + "Azure Function" |
| 276 | + ], |
| 277 | + "postDeployment": [ |
| 278 | + "Deploy the TacitRedToDefenderTI playbook and provide the Function App URL" |
| 279 | + ], |
| 280 | + "releaseNotes": [ |
| 281 | + { |
| 282 | + "version": "1.0.0", |
| 283 | + "title": "TacitRedDefenderTI_FunctionApp", |
| 284 | + "notes": [ |
| 285 | + "Initial version" |
| 286 | + ] |
| 287 | + } |
| 288 | + ] |
| 289 | + } |
287 | 290 | }, |
288 | 291 | "packageKind": "Solution", |
289 | 292 | "packageVersion": "[variables('_solutionVersion')]", |
|
325 | 328 | "description": "TacitRed API Key for authentication" |
326 | 329 | } |
327 | 330 | }, |
328 | | - "FunctionAppUrl": { |
| 331 | + "FunctionAppName": { |
329 | 332 | "type": "string", |
| 333 | + "defaultValue": "tacitreddefenderti", |
330 | 334 | "metadata": { |
331 | | - "description": "URL of the deployed TacitRed Azure Function App (e.g., https://tacitreddefendertiXXX.azurewebsites.net/api/TacitRedToDefenderTI)" |
| 335 | + "description": "Prefix for the Azure Function App name" |
332 | 336 | } |
333 | 337 | } |
334 | 338 | }, |
335 | 339 | "variables": { |
336 | 340 | "logicAppName": "[[parameters('PlaybookName')]", |
| 341 | + "functionAppName": "[[concat(parameters('FunctionAppName'), uniqueString(resourceGroup().id))]", |
337 | 342 | "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", |
338 | 343 | "workspace-name": "[parameters('workspace')]", |
339 | 344 | "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" |
|
375 | 380 | { |
376 | 381 | "name": "FunctionAppUrl", |
377 | 382 | "type": "String", |
378 | | - "value": "[[parameters('FunctionAppUrl')]" |
| 383 | + "value": "[[concat('https://', reference(resourceId('Microsoft.Web/sites', variables('functionAppName')), '2024-04-01').defaultHostName, '/api/TacitRedToDefenderTI')]" |
379 | 384 | }, |
380 | 385 | { |
381 | 386 | "name": "Domains", |
|
505 | 510 | "contentSchemaVersion": "3.0.0", |
506 | 511 | "displayName": "TacitRed-Defender-ThreatIntelligence", |
507 | 512 | "publisherDisplayName": "Data443 Risk Mitigation, Inc.", |
508 | | - "descriptionHtml": "<p><strong>Note:</strong> Please refer to the following before installing the solution:</p>\n<p>• Review the solution <a href=\"https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/TacitRed-Defender-ThreatIntelligence/ReleaseNotes.md\">Release Notes</a></p>\n<p>• There may be <a href=\"https://aka.ms/sentinelsolutionsknownissues\">known issues</a> pertaining to this Solution, please refer to them before installing.</p>\n<p>The TacitRed Defender Threat Intelligence solution integrates TacitRed's threat intelligence feed with Microsoft Sentinel. It automatically retrieves compromised credentials and other threat indicators from TacitRed and ingests them into Microsoft Sentinel using the Upload API for enhanced threat detection.</p>\n<p><strong>Function Apps:</strong> 1, <strong>Playbooks:</strong> 1</p>\n<p><a href=\"https://aka.ms/azuresentinel\">Learn more about Microsoft Sentinel</a> | <a href=\"https://aka.ms/azuresentinelsolutionsdoc\">Learn more about Solutions</a></p>\n", |
| 513 | + "descriptionHtml": "<p><strong>Note:</strong> Please refer to the following before installing the solution:</p>\n<p>• Review the solution <a href=\"https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/TacitRed-Defender-ThreatIntelligence/ReleaseNotes.md\">Release Notes</a></p>\n<p>• There may be <a href=\"https://aka.ms/sentinelsolutionsknownissues\">known issues</a> pertaining to this Solution, please refer to them before installing.</p>\n<p>The TacitRed Defender Threat Intelligence solution integrates TacitRed's threat intelligence feed with Microsoft Sentinel. It automatically retrieves compromised credentials and other threat indicators from TacitRed and ingests them into Microsoft Sentinel using the Upload API for enhanced threat detection.</p>\n<p><strong>Function Apps:</strong> 1, <strong>Playbooks:</strong> 1</p>\n<p><a href=\"https://aka.ms/azuresentinel\">Learn more about Microsoft Sentinel</a> | <a href=\"https://aka.ms/azuresentinelsolutionsdoc\">Learn more about Solutions</a></p>\n", |
509 | 514 | "contentKind": "Solution", |
510 | 515 | "contentProductId": "[variables('_solutioncontentProductId')]", |
511 | 516 | "id": "[variables('_solutioncontentProductId')]", |
512 | | - "icon": "<svg id=\"d4e9f9a0-1b2c-4d4e-9f6a-7b8c9d0e1f2a\" xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 200 50\" width=\"75px\" height=\"75px\"><text x=\"10\" y=\"35\" font-family=\"Arial, sans-serif\" font-size=\"24\" font-weight=\"bold\" fill=\"#000000\">Tacit</text><text x=\"70\" y=\"35\" font-family=\"Arial, sans-serif\" font-size=\"24\" font-weight=\"bold\" fill=\"#FF0000\">Red</text><text x=\"120\" y=\"35\" font-family=\"Arial, sans-serif\" font-size=\"12\" fill=\"#555555\">by Data443</text></svg>", |
| 517 | + "icon": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/tacitred_logo.svg\"width=\"75px\"height=\"75px\">", |
513 | 518 | "contentId": "[variables('_solutionId')]", |
514 | 519 | "parentId": "[variables('_solutionId')]", |
515 | 520 | "source": { |
|
0 commit comments