Skip to content

Commit 2aeddd9

Browse files
v-atulyadavv-atulyadav
authored
Merge pull request #12643 from recordedfuture/fix-indicator-import-stix-id
fix: indicator import stix id and description formatting
2 parents 9976cb1 + 6d63c76 commit 2aeddd9

File tree

12 files changed

+224
-125
lines changed

12 files changed

+224
-125
lines changed

‎Solutions/Recorded Future/Data/Solution_RecordedFuture.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@
3636
"Workbooks/RecordedFutureMalwareThreatHunting.json"
3737
],
3838
"BasePath": "Users\\emangsten\\git\\github\\Azure-Sentinel\\Solutions\\Recorded Future",
39-
"Version": "3.2.16",
39+
"Version": "3.2.17",
4040
"Metadata": "SolutionMetadata.json",
4141
"TemplateSpec": true,
4242
"Is1Pconnector": false

‎Solutions/Recorded Future/Package/3.2.17.zip‎

45.7 KB
Binary file not shown.

‎Solutions/Recorded Future/Package/mainTemplate.json‎

Lines changed: 148 additions & 94 deletions
Large diffs are not rendered by default.

‎Solutions/Recorded Future/Playbooks/Alerts/RecordedFuture-Playbook-Alert-Importer/azuredeploy.json‎

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
3-
"contentVersion": "1.0.0.0",
3+
"contentVersion": "1.4.0.0",
44
"metadata": {
55
"title": "RecordedFuture-Playbook-Alert-Importer",
66
"description": "This playbook imports alerts from Recorded Future and stores them in a custom log in the log analytics workspace.",
@@ -11,7 +11,7 @@
1111
"After deployment, open the playbook to configure all connections and press save."
1212
],
1313
"prerequisitesDeployTemplateFile": "",
14-
"lastUpdateTime": "2024-07-09T00:00:00.000Z",
14+
"lastUpdateTime": "2025-08-12T00:00:00.000Z",
1515
"entities": [],
1616
"tags": [ "Alert" ],
1717
"support": {
@@ -30,7 +30,7 @@
3030
{
3131
"version": "1.1",
3232
"title": "RecordedFuture-Playbook-Alert-Importer",
33-
"notes": [ "Changed default search parameters for playbook alert serach." ]
33+
"notes": [ "Changed default search parameters for playbook alert search." ]
3434
},
3535
{
3636
"version": "1.2",
@@ -41,6 +41,11 @@
4141
"version": "1.3",
4242
"title": "RecordedFuture-Playbook-Alert-Importer",
4343
"notes": [ "Added Incident creation." ]
44+
},
45+
{
46+
"version": "1.4",
47+
"title": "RecordedFuture-Playbook-Alert-Importer",
48+
"notes": [ "Added parameter for Microsoft Sentinel workspace name, Updated formatting for incident description" ]
4449
}
4550
]
4651
},
@@ -55,6 +60,13 @@
5560
"metadata": {
5661
"description": "Create Microsoft Sentinel incidents (possible values true/false)"
5762
}
63+
},
64+
"workspace_name": {
65+
"defaultValue": "",
66+
"metadata": {
67+
"description": "Microsoft Sentinel Workspace name"
68+
},
69+
"type": "string"
5870
}
5971
},
6072
"variables": {
@@ -146,7 +158,7 @@
146158
"title": "@body('Get_Playbook_Alert_by_ID')?['title']",
147159
"severity": "Medium",
148160
"status": "New",
149-
"description": "**Recorded Future Alert**\n@{body('Get_Playbook_Alert_by_ID')?['title']}\nPlaybook Alert ID: @{body('Get_Playbook_Alert_by_ID')?['id']}\nPlaybook Alert Type: @{items('For_each')?['category']}\nPlaybook Alert Priority: @{items('For_each')?['priority']}\nPlaybook Alert Status: @{item()?['status']}\nPlaybook Alert Targets:@{body('Get_Playbook_Alert_by_ID')?['targets']}\n[Open Recorded Future portal](@{concat('https://app.recordedfuture.com/live/sc/task/?id=',items('For_each')?['playbook_alert_id'])})\n\nEvidence Summary: @{body('Get_Playbook_Alert_by_ID')?['evidence_summary']}\n\ncreated_date: @{items('For_each')?['created']}\nupdated_date: @{items('For_each')?['updated']}\n\n",
161+
"description": "**Recorded Future Alert**\n@{body('Get_Playbook_Alert_by_ID')?['title']}\n\nPlaybook Alert ID: @{body('Get_Playbook_Alert_by_ID')?['id']}\n\nPlaybook Alert Type: @{items('For_each')?['category']}\n\nPlaybook Alert Priority: @{items('For_each')?['priority']}\n\nPlaybook Alert Status: @{item()?['status']}\n\nPlaybook Alert Targets:@{body('Get_Playbook_Alert_by_ID')?['targets']}\n\n[Open Recorded Future portal](@{concat('https://app.recordedfuture.com/live/sc/task/?id=',items('For_each')?['playbook_alert_id'])})\n\nEvidence Summary: @{body('Get_Playbook_Alert_by_ID')?['evidence_summary']}\n\ncreated_date: @{items('For_each')?['created']}\n\nupdated_date: @{items('For_each')?['updated']}\n\n",
150162
"tagsToAdd": {
151163
"TagsToAdd": [
152164
{
@@ -158,7 +170,7 @@
158170
]
159171
}
160172
},
161-
"path": "/Incidents/subscriptions/5129b3ff-c0c6-4e86-bd1c-70e5fcd579cf/resourceGroups/RF-SaaS-V3.2.2/workspaces/RF-SaaS-V3-2-2"
173+
"path": "[concat('/Incidents/subscriptions/', subscription().subscriptionId,'/resourceGroups/',resourceGroup().name,'/workspaces/',parameters('workspace_name') ) ]"
162174
}
163175
}
164176
},
@@ -263,7 +275,7 @@
263275
"location": "[resourceGroup().location]",
264276
"tags": {
265277
"hidden-SentinelTemplateName": "PlaybookAlert-Import",
266-
"hidden-SentinelTemplateVersion": "1.3"
278+
"hidden-SentinelTemplateVersion": "1.4"
267279
},
268280
"identity": {
269281
"type": "SystemAssigned"

‎Solutions/Recorded Future/Playbooks/IndicatorImport/RecordedFuture-Domain-IndicatorImport/azuredeploy.json‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
3-
"contentVersion": "1.2.0.0",
3+
"contentVersion": "1.3.0.0",
44
"metadata": {
55
"title": "RecordedFuture-Domain-IndicatorImport",
66
"description": "This playbook imports Domain risk lists from Recorded Future and stores them as Threat Intelligence Indicators in Microsoft Sentinel, for detection purposes.\n\nThis playbook depends on RecordedFuture-ThreatIntelligenceImport that need to be installed **manually** before installing this playbook.",
@@ -12,7 +12,7 @@
1212
"After deployment, open the playbook to configure all connections and press save."
1313
],
1414
"prerequisitesDeployTemplateFile": "../RecordedFuture-ThreatIntelligenceImport/azuredeploy.json",
15-
"lastUpdateTime": "2025-01-29T00:00:00.000Z",
15+
"lastUpdateTime": "2025-08-12T00:00:00.000Z",
1616
"entities": [],
1717
"tags": [ "Threat Intelligence" ],
1818
"support": {
@@ -37,6 +37,11 @@
3737
"version": "1.2",
3838
"title": "Minor rename",
3939
"notes": [ "Rename logic app block for consistency." ]
40+
},
41+
{
42+
"version": "1.3",
43+
"title": "Deterministic STIX ID added",
44+
"notes": [ "Added fetching of deterministic STIX ID, to avoid duplicate IOCs" ]
4045
}
4146
]
4247
},
@@ -134,6 +139,9 @@
134139
},
135140
"riskString": {
136141
"type": "string"
142+
},
143+
"stix_id": {
144+
"type": "string"
137145
}
138146
},
139147
"type": "object"
@@ -153,7 +161,7 @@
153161
"confidence": "@int(body('Parse_JSON')?['Risk'])",
154162
"created": "@{utcNow()}",
155163
"description": "Recorded Future - Domains - Command and Control Activity",
156-
"id": "indicator--@{guid()}",
164+
"id": "@{body('Parse_JSON')?['stix_id']}",
157165
"indicator_types": [
158166
"malicious-activity"
159167
],
@@ -225,7 +233,7 @@
225233
"apiVersion": "2017-07-01",
226234
"tags": {
227235
"hidden-SentinelTemplateName": "RecordedFuture-Domain-IndicatorImport",
228-
"hidden-SentinelTemplateVersion": "1.2"
236+
"hidden-SentinelTemplateVersion": "1.3"
229237
},
230238
"dependsOn": [
231239
"[resourceId('Microsoft.Web/connections', variables('RecordedfutureConnectionName'))]"

‎Solutions/Recorded Future/Playbooks/IndicatorImport/RecordedFuture-Hash-IndicatorImport/azuredeploy.json‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
3-
"contentVersion": "1.2.0.0",
3+
"contentVersion": "1.3.0.0",
44
"metadata": {
55
"title": "RecordedFuture-Hash-IndicatorImport",
66
"description": "This playbook imports Hash risk lists from Recorded Future and stores them as Threat Intelligence Indicators in Microsoft Sentinel, for detection purposes.\n\nThis playbook depends on RecordedFuture-ThreatIntelligenceImport that need to be installed **manually** before installing this playbook.",
@@ -12,7 +12,7 @@
1212
"After deployment, open the playbook to configure all connections and press save."
1313
],
1414
"prerequisitesDeployTemplateFile": "../RecordedFuture-ThreatIntelligenceImport/azuredeploy.json",
15-
"lastUpdateTime": "2025-01-30T00:00:00.000Z",
15+
"lastUpdateTime": "2025-08-12T00:00:00.000Z",
1616
"entities": [],
1717
"tags": [ "Threat Intelligence" ],
1818
"support": {
@@ -37,6 +37,11 @@
3737
"version": "1.2",
3838
"title": "Minor rename",
3939
"notes": [ "Rename logic app block for consistency." ]
40+
},
41+
{
42+
"version": "1.3",
43+
"title": "Deterministic STIX ID added",
44+
"notes": [ "Added fetching of deterministic STIX ID, to avoid duplicate IOCs" ]
4045
}
4146
]
4247
},
@@ -135,6 +140,9 @@
135140
},
136141
"riskString": {
137142
"type": "string"
143+
},
144+
"stix_id": {
145+
"type": "string"
138146
}
139147
},
140148
"type": "object"
@@ -154,7 +162,7 @@
154162
"confidence": "@int(body('Parse_JSON')?['Risk'])",
155163
"created": "@{utcNow()}",
156164
"description": "Recorded Future - HASH - Observed in Underground Virus Testing Sites",
157-
"id": "indicator--@{guid()}",
165+
"id": "@{body('Parse_JSON')?['stix_id']}",
158166
"indicator_types": [
159167
"malicious-activity"
160168
],
@@ -226,7 +234,7 @@
226234
"apiVersion": "2017-07-01",
227235
"tags": {
228236
"hidden-SentinelTemplateName": "RecordedFuture-Hash-IndicatorImport",
229-
"hidden-SentinelTemplateVersion": "1.2"
237+
"hidden-SentinelTemplateVersion": "1.3"
230238
},
231239
"dependsOn": [
232240
"[resourceId('Microsoft.Web/connections', variables('RecordedfutureConnectionName'))]"

‎Solutions/Recorded Future/Playbooks/IndicatorImport/RecordedFuture-IP-IndicatorImport/azuredeploy.json‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
3-
"contentVersion": "1.2.0.0",
3+
"contentVersion": "1.3.0.0",
44
"metadata": {
55
"title": "RecordedFuture-IP-IndicatorImport",
66
"description": "This playbook imports IP risk lists from Recorded Future and stores them as Threat Intelligence Indicators in Microsoft Sentinel, for detection purposes.\n\nThis playbook depends on RecordedFuture-ThreatIntelligenceImport that need to be installed **manually** before installing this playbook.",
@@ -13,7 +13,7 @@
1313
"After deployment, open the playbook to configure all connections and press save."
1414
],
1515
"prerequisitesDeployTemplateFile": "../RecordedFuture-ThreatIntelligenceImport/azuredeploy.json",
16-
"lastUpdateTime": "2025-01-30T17:00:00.000Z",
16+
"lastUpdateTime": "2025-08-12T00:00:00.000Z",
1717
"entities": [],
1818
"tags": [ "Threat Intelligence" ],
1919
"support": {
@@ -37,6 +37,11 @@
3737
"version": "1.2",
3838
"title": "Minor rename",
3939
"notes": [ "Rename logic app block for consistency." ]
40+
},
41+
{
42+
"version": "1.3",
43+
"title": "Deterministic STIX ID added",
44+
"notes": [ "Added fetching of deterministic STIX ID, to avoid duplicate IOCs" ]
4045
}
4146
]
4247
},
@@ -135,6 +140,9 @@
135140
},
136141
"riskString": {
137142
"type": "string"
143+
},
144+
"stix_id": {
145+
"type": "string"
138146
}
139147
},
140148
"type": "object"
@@ -154,7 +162,7 @@
154162
"confidence": "@int(body('Parse_JSON')?['Risk'])",
155163
"created": "@{utcNow()}",
156164
"description": "Recorded Future - IP - Actively Communicating C&C Server",
157-
"id": "indicator--@{guid()}",
165+
"id": "@{body('Parse_JSON')?['stix_id']}",
158166
"indicator_types": [
159167
"malicious-activity"
160168
],
@@ -226,7 +234,7 @@
226234
"apiVersion": "2017-07-01",
227235
"tags": {
228236
"hidden-SentinelTemplateName": "RecordedFuture-IP-IndicatorImport",
229-
"hidden-SentinelTemplateVersion": "1.2"
237+
"hidden-SentinelTemplateVersion": "1.3"
230238
},
231239
"dependsOn": [
232240
"[resourceId('Microsoft.Web/connections', variables('RecordedfutureConnectionName'))]"

‎Solutions/Recorded Future/Playbooks/IndicatorImport/RecordedFuture-URL-IndicatorImport/azuredeploy.json‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
3-
"contentVersion": "1.2.0.0",
3+
"contentVersion": "1.3.0.0",
44
"metadata": {
55
"title": "RecordedFuture-URL-IndicatorImport",
66
"description": "This playbook imports URL risk lists from Recorded Future and stores them as Threat Intelligence Indicators in Microsoft Sentinel, for detection purposes.\n\nThis playbook depends on RecordedFuture-ThreatIntelligenceImport that need to be installed **manually** before installing this playbook.",
@@ -12,7 +12,7 @@
1212
"After deployment, open the playbook to configure all connections and press save."
1313
],
1414
"prerequisitesDeployTemplateFile": "../RecordedFuture-ThreatIntelligenceImport/azuredeploy.json",
15-
"lastUpdateTime": "2025-01-30T00:00:00.000Z",
15+
"lastUpdateTime": "2025-08-12T00:00:00.000Z",
1616
"entities": [],
1717
"tags": [ "Threat Intelligence" ],
1818
"support": {
@@ -37,6 +37,11 @@
3737
"version": "1.2",
3838
"title": "Minor rename",
3939
"notes": [ "Rename logic app block for consistency." ]
40+
},
41+
{
42+
"version": "1.3",
43+
"title": "Deterministic STIX ID added",
44+
"notes": [ "Added fetching of deterministic STIX ID, to avoid duplicate IOCs" ]
4045
}
4146
]
4247
},
@@ -134,6 +139,9 @@
134139
},
135140
"riskString": {
136141
"type": "string"
142+
},
143+
"stix_id": {
144+
"type": "string"
137145
}
138146
},
139147
"type": "object"
@@ -153,7 +161,7 @@
153161
"confidence": "@int(body('Parse_JSON')?['Risk'])",
154162
"created": "@{utcNow()}",
155163
"description": "Recorded Future - URL - Recently Reported by Insikt Group",
156-
"id": "indicator--@{guid()}",
164+
"id": "@{body('Parse_JSON')?['stix_id']}",
157165
"indicator_types": [
158166
"malicious-activity"
159167
],
@@ -225,7 +233,7 @@
225233
"apiVersion": "2017-07-01",
226234
"tags": {
227235
"hidden-SentinelTemplateName": "RecordedFuture-URL-IndicatorImport",
228-
"hidden-SentinelTemplateVersion": "1.2"
236+
"hidden-SentinelTemplateVersion": "1.3"
229237
},
230238
"dependsOn": [
231239
"[resourceId('Microsoft.Web/connections', variables('RecordedfutureConnectionName'))]"

‎Solutions/Recorded Future/Playbooks/IndicatorImport/readme.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ Its possible to adjust the cadence of Risk List download to reduce traffic and c
101101
The first step of IndicatorImport Playbooks is a recurrence step, adjust the cadence by modifying the interval and frequency parameters.\
102102
<img src="../Images/2023-12-12-10-00-53.png" width="1000">
103103

104-
It is critical that you also adjust the expirationDateTime parameter in the final block of that logic app to be synchronized with the recurrence timing. Failure to do so can result in either:
104+
It is critical that you also adjust the ``valid_until`` parameter in the final block of that logic app to be synchronized with the recurrence timing. Failure to do so can result in either:
105105
* Duplication of indicators.
106106
* Having no active Recorded Future indicators the majority of the time.
107107

0 commit comments

Comments
 (0)