Skip to content

Commit 924104c

Browse files
v-atulyadavv-atulyadav
authored
Merge pull request Azure#12613 from Azure/updatemdeplaybookscan
Updating MDE playbook with newer logic
2 parents bc4e688 + 22484d3 commit 924104c

File tree

18 files changed

+3617
-3036
lines changed

18 files changed

+3617
-3036
lines changed

‎Solutions/MicrosoftDefenderForEndpoint/Package/3.0.5.zip‎

27 KB
Binary file not shown.

‎Solutions/MicrosoftDefenderForEndpoint/Package/mainTemplate.json‎

Lines changed: 1967 additions & 1597 deletions
Large diffs are not rendered by default.

‎Solutions/MicrosoftDefenderForEndpoint/Playbooks/Restrict-MDEFileHash/Restrict-MDEFileHash-alert-trigger/azuredeploy.json‎

Lines changed: 169 additions & 135 deletions
Large diffs are not rendered by default.

‎Solutions/MicrosoftDefenderForEndpoint/Playbooks/Restrict-MDEFileHash/Restrict-MDEFileHash-entity-trigger/azuredeploy.json‎

Lines changed: 70 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -3,33 +3,33 @@
33
"contentVersion": "1.0.0.0",
44
"metadata": {
55
"title": "Restrict MDE FileHash - Entity Triggered",
6-
"description": "This playbook will take the triggering FileHash entity and generate an alert and block threat indicator for the file hash in MDE for 90 days.",
7-
"prerequisites": "- **For Gov Only** \n\n You will need to update the HTTP action URL to the correct URL documented [here](https://docs.microsoft.com/microsoft-365/security/defender-endpoint/gov?view=o365-worldwide#api) \n\n - You will need to grant Ti.ReadWrite permissions and assign Microsoft Sentinel Reader to the resource group for the managed identity. Run the following code replacing the managed identity object id, subscriptionId and resource group. You find the managed identity object id on the Identity blade under Settings for the Logic App. \n\n ```powershell \n\n $MIGuid = '<Enter your managed identity guid here>' \n\n $SubscriptionId = '<Enter your subsciption id here>' \n\n $ResourceGroup = '<Enter your resource group here>' \n\n $MI = Get-AzureADServicePrincipal -ObjectId $MIGuid \n\n $MDEAppId = 'fc780465-2017-40d4-a0c5-307022471b92' \n\n $PermissionName = 'Ti.ReadWrite' \n\n $RoleName = 'Microsoft Sentinel Responder' \n\n $MDEServicePrincipal = Get-AzureADServicePrincipal -Filter \"appId eq '$MDEAppId'\" \n\n $AppRole = $MDEServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionName -and $_.AllowedMemberTypes -contains 'Application'} \n\n New-AzureAdServiceAppRoleAssignment -ObjectId $MI.ObjectId -PrincipalId $MI.ObjectId ` -ResourceId $MDEServicePrincipal.ObjectId -Id $AppRole.Id \n\n New-AzRoleAssignment -ObjectId $MIGuid -RoleDefinitionName $RoleName -Scope /subscriptions/$SubscriptionId/resourcegroups/$ResourceGroup \n\n ```",
8-
"postDeployment": ["Assign Playbook Microsoft Sentinel Responder Role",
9-
"1. Select the Playbook (Logic App) resource",
10-
"2. Click on Identity Blade",
11-
"3. Choose System assigned tab",
12-
"4. Click on Azure role assignments",
13-
"5. Click on Add role assignments",
14-
"6. Select Scope - Resource group",
15-
"7. Select Subscription - where Playbook has been created",
16-
"8. Select Resource group - where Playbook has been created",
17-
"9. Select Role - Microsoft Sentinel Responder",
18-
"10. Click Save (It takes 3-5 minutes to show the added role.)"],
19-
"prerequisitesDeployTemplateFile": "",
20-
"lastUpdateTime": "2023-02-26T00:00:00Z",
21-
"entities": [
22-
"FileHash"
23-
],
24-
"tags": [
25-
"Remediation"
6+
"description": "This playbook will take the triggering FileHash entity and generate an alert and block threat indicator for the file hash in MDE for 90 days. It will also add a comment to the incident with the file hash and action taken.",
7+
"prerequisites": "",
8+
"postDeployment": [
9+
"- **For Gov Only** \n\n You will need to update the HTTP action URL to the correct URL documented [here](https://docs.microsoft.com/microsoft-365/security/defender-endpoint/gov?view=o365-worldwide#api) \n\n - You will need to grant Ti.ReadWrite permissions to the managed identity. Run the following code replacing the managed identity object id. You find the managed identity object id on the Identity blade under Settings for the Logic App. \n\n ```powershell \n\n $MIGuid = '<Enter your managed identity guid here>' \n\n $MI = Get-AzureADServicePrincipal -ObjectId $MIGuid \n\n $MDEAppId = 'fc780465-2017-40d4-a0c5-307022471b92' \n\n $PermissionName = 'Ti.ReadWrite' \n\n $MDEServicePrincipal = Get-AzureADServicePrincipal -Filter \"appId eq '$MDEAppId'\" \n\n $AppRole = $MDEServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionName -and $_.AllowedMemberTypes -contains 'Application'} \n\n New-AzureAdServiceAppRoleAssignment -ObjectId $MI.ObjectId -PrincipalId $MI.ObjectId ` -ResourceId $MDEServicePrincipal.ObjectId -Id $AppRole.Id \n\n ```",
10+
"Assign Playbook Microsoft Sentinel Responder Role",
11+
"1. Select the Playbook (Logic App) resource",
12+
"2. Click on Identity Blade",
13+
"3. Choose System assigned tab",
14+
"4. Click on Azure role assignments",
15+
"5. Click on Add role assignments",
16+
"6. Select Scope - Resource group",
17+
"7. Select Subscription - where Playbook has been created",
18+
"8. Select Resource group - where Playbook has been created",
19+
"9. Select Role - Microsoft Sentinel Responder",
20+
"10. Click Save (It takes 3-5 minutes to show the added role.)",
21+
"[click here for detail instructions](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/MicrosoftDefenderForEndpoint/Playbooks/Restrict-MDEFileHash/readme.md)"
2622
],
23+
"prerequisitesDeployTemplateFile": "",
24+
"lastUpdateTime": "2025-08-01T00:00:00Z",
25+
"entities": ["FileHash"],
26+
"tags": ["Remediation"],
2727
"support": {
28-
"tier": "community",
28+
"tier": "Microsoft",
2929
"armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator"
3030
},
3131
"author": {
32-
"name": "Sarah van den Bovenkamp"
32+
"name": "Microsoft"
3333
}
3434
},
3535
"parameters": {
@@ -59,35 +59,34 @@
5959
"Microsoft_Sentinel_entity_(FileHash)": {
6060
"type": "ApiConnectionWebhook",
6161
"inputs": {
62-
"body": {
63-
"callback_url": "@{listCallbackUrl()}"
64-
},
6562
"host": {
6663
"connection": {
67-
"name": "@parameters('$connections')['azuresentinel_2']['connectionId']"
64+
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
6865
}
6966
},
67+
"body": {
68+
"callback_url": "@{listCallbackUrl()}"
69+
},
7070
"path": "/entity/@{encodeURIComponent('FileHash')}"
7171
}
7272
}
7373
},
7474
"actions": {
7575
"Condition": {
7676
"actions": {
77-
"Add_comment_to_incident_(V3)_2": {
78-
"runAfter": {},
77+
"Add_comment_to_incident_(V3)-1": {
7978
"type": "ApiConnection",
8079
"inputs": {
81-
"body": {
82-
"incidentArmId": "@triggerBody()?['IncidentArmID']",
83-
"message": "<p>An AlertAndBlock request has been sent to the security centre API for file with hash: @{triggerBody()?['Entity']?['properties']?['Value']}. Note that the expiration time on this is 90 days.<br>\nThe response from the API was: @{outputs('HTTP_Alert_and_Block_Sha1')['statusCode']}</p>"
84-
},
8580
"host": {
8681
"connection": {
87-
"name": "@parameters('$connections')['azuresentinel_2']['connectionId']"
82+
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
8883
}
8984
},
9085
"method": "post",
86+
"body": {
87+
"incidentArmId": "@triggerBody()?['IncidentArmID']",
88+
"message": "<p class=\"editor-paragraph\">An AlertAndBlock request has been sent to the security centre API for file with hash: @{triggerBody()?['Entity']?['properties']?['Value']}. Note that the expiration time on this is 90 days.<br>The response from the API was: @{outputs('HTTP_Alert_and_Block_Sha1')?['statusCode']} @{outputs('HTTP_Alert_and_Block_Sha256')?['statusCode']}</p>"
89+
},
9190
"path": "/Incidents/Comment"
9291
}
9392
}
@@ -97,6 +96,26 @@
9796
"Succeeded"
9897
]
9998
},
99+
"else": {
100+
"actions": {
101+
"Add_comment_to_incident_(V3)-2": {
102+
"type": "ApiConnection",
103+
"inputs": {
104+
"host": {
105+
"connection": {
106+
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
107+
}
108+
},
109+
"method": "post",
110+
"body": {
111+
"incidentArmId": "@triggerBody()?['IncidentArmID']",
112+
"message": "<p class=\"editor-paragraph\">Provided Algorithm was not SHA1 or SHA256 , So no action has been taken</p>"
113+
},
114+
"path": "/Incidents/Comment"
115+
}
116+
}
117+
}
118+
},
100119
"expression": {
101120
"and": [
102121
{
@@ -134,12 +153,12 @@
134153
"case": "SHA1",
135154
"actions": {
136155
"HTTP_Alert_and_Block_Sha1": {
137-
"runAfter": {},
138156
"type": "Http",
139157
"inputs": {
140-
"authentication": {
141-
"audience": "https://api.securitycenter.windows.com/",
142-
"type": "ManagedServiceIdentity"
158+
"uri": "https://api.securitycenter.windows.com/api/indicators",
159+
"method": "POST",
160+
"headers": {
161+
"Content-type": "application/json"
143162
},
144163
"body": {
145164
"action": "AlertAndBlock",
@@ -150,11 +169,10 @@
150169
"indicatorValue": "@{triggerBody()?['Entity']?['properties']?['Value']}",
151170
"title": "@{guid()}"
152171
},
153-
"headers": {
154-
"Content-type": "application/json"
155-
},
156-
"method": "POST",
157-
"uri": "https://api.securitycenter.windows.com/api/indicators"
172+
"authentication": {
173+
"audience": "https://api.securitycenter.windows.com/",
174+
"type": "ManagedServiceIdentity"
175+
}
158176
}
159177
}
160178
}
@@ -163,12 +181,12 @@
163181
"case": "SHA256",
164182
"actions": {
165183
"HTTP_Alert_and_Block_Sha256": {
166-
"runAfter": {},
167184
"type": "Http",
168185
"inputs": {
169-
"authentication": {
170-
"audience": "https://api.securitycenter.windows.com/",
171-
"type": "ManagedServiceIdentity"
186+
"uri": "https://api.securitycenter.windows.com/api/indicators",
187+
"method": "POST",
188+
"headers": {
189+
"Content-type": "application/json"
172190
},
173191
"body": {
174192
"action": "AlertAndBlock",
@@ -179,11 +197,10 @@
179197
"indicatorValue": "@{triggerBody()?['Entity']?['properties']?['Value']}",
180198
"title": "@{guid()}"
181199
},
182-
"headers": {
183-
"Content-type": "application/json"
184-
},
185-
"method": "POST",
186-
"uri": "https://api.securitycenter.windows.com/api/indicators"
200+
"authentication": {
201+
"audience": "https://api.securitycenter.windows.com/",
202+
"type": "ManagedServiceIdentity"
203+
}
187204
}
188205
}
189206
}
@@ -201,7 +218,7 @@
201218
"parameters": {
202219
"$connections": {
203220
"value": {
204-
"azuresentinel_2": {
221+
"azuresentinel": {
205222
"connectionId": "[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]",
206223
"connectionName": "[variables('MicrosoftSentinelConnectionName')]",
207224
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/Azuresentinel')]",
@@ -246,4 +263,4 @@
246263
}
247264
}
248265
]
249-
}
266+
}

0 commit comments

Comments
 (0)