Skip to content

Commit 70f4c89

Browse files
v-prasadbokev-prasadboke
authored
Merge pull request #12237 from Azure/origin/users/rahul/test-vt-playbooks
Update playbook documentation and deployment templates
2 parents 7dda2bd + 79514ed commit 70f4c89

File tree

16 files changed

+519
-366
lines changed

16 files changed

+519
-366
lines changed

‎Solutions/VirusTotal/Package/3.0.1.zip‎

11.2 KB
Binary file not shown.

‎Solutions/VirusTotal/Package/createUiDefinition.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"config": {
77
"isWizard": false,
88
"basics": {
9-
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/VirusTotal/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [VirusTotal](https://www.virustotal.com/gui/) solution for Microsoft Sentinel contains Playbooks that can help enrich incident information with threat information and intelligence for IPs, file hashes and URLs from VirusTotal. Enriched information can help drive focused investigations in Security Operations.\n\n**Playbooks:** 9\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
9+
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/VirusTotal/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [VirusTotal](https://www.virustotal.com/gui/) solution for Microsoft Sentinel contains Playbooks that can help enrich incident information with threat information and intelligence for IPs, file hashes and URLs from VirusTotal. Enriched information can help drive focused investigations in Security Operations.\n\n**Playbooks:** 9\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
1010
"subscription": {
1111
"resourceProviders": [
1212
"Microsoft.OperationsManagement/solutions",
@@ -86,4 +86,4 @@
8686
"workspace": "[basics('workspace')]"
8787
}
8888
}
89-
}
89+
}

‎Solutions/VirusTotal/Package/mainTemplate.json‎

Lines changed: 158 additions & 156 deletions
Large diffs are not rendered by default.

‎Solutions/VirusTotal/Playbooks/Get-VirusTotalDomainReport/alert-trigger/azuredeploy.json‎

Lines changed: 14 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -3,33 +3,27 @@
33
"contentVersion": "1.0.0.0",
44
"metadata": {
55
"comments": "This playbook will take each URL entity and query VirusTotal for domain info (https://developers.virustotal.com/v3.0/reference#domain-info).",
6-
"title": "URL Enrichment - Virus Total domain report - Alert Triggered",
6+
"title": "URL Enrichment - Virus Total Domain Report - Alert Triggered",
77
"description": "This playbook will take each URL entity and query VirusTotal for Domain info (https://developers.virustotal.com/v3.0/reference#domain-info).",
88
"prerequisites": [
9-
"Register on VirusTotal portal and get an API key."
9+
"VirusTotal API key, Register to VirusTotal community. [Register here](https://www.virustotal.com/gui/join-us)"
1010
],
1111
"postDeployment": [
1212
"1. Authorize/Configure all the connections.",
13-
"2. Assign Microsoft Sentinel Responder Role to playbook."
13+
"2. Assign Log Analytics Reader Role to playbook on Log Analytics Workspace.",
14+
"3. Assign Microsoft Sentinel Responder Role to playbook.",
15+
"4. After deployment, attach this playbook to an **automation rule** and map URL entity so it runs when alert is triggered.",
16+
"[click here for detail instructions](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VirusTotal/Playbooks/Get-VirusTotalDomainReport/readme.md)"
1417
],
15-
"lastUpdateTime": "2023-02-03T00:00:00.000Z",
18+
"lastUpdateTime": "2025-05-28T00:00:00.000Z",
1619
"entities": ["URL"],
1720
"tags": ["Enrichment"],
1821
"support": {
1922
"tier": "Community"
2023
},
2124
"author": {
2225
"name": "Nicholas DiCola"
23-
},
24-
"releaseNotes": [
25-
{
26-
"version": "1.0.1",
27-
"title": "URL Enrichment - Virus Total domain report",
28-
"notes": [
29-
"Initial version"
30-
]
31-
}
32-
]
26+
}
3327
},
3428
"parameters": {
3529
"PlaybookName": {
@@ -38,9 +32,9 @@
3832
}
3933
},
4034
"variables": {
41-
"AzureLogAnalyticsDataCollectorConnectionName": "[concat('azureloganalyticsdatacollector-', parameters('PlaybookName'))]",
42-
"AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]",
43-
"VirusTotalConnectionName": "[concat('virustotal-',parameters('PlaybookName'))]"
35+
"AzureLogAnalyticsDataCollectorConnectionName": "[concat('AzureLogAnalyticsDataCollector-', parameters('PlaybookName'))]",
36+
"AzureSentinelConnectionName": "[concat('MicrosoftSentinel-', parameters('PlaybookName'))]",
37+
"VirusTotalConnectionName": "[concat('VirusTotal-',parameters('PlaybookName'))]"
4438
},
4539
"resources": [
4640
{
@@ -50,7 +44,6 @@
5044
"location": "[resourceGroup().location]",
5145
"properties": {
5246
"displayName": "[variables('AzureLogAnalyticsDataCollectorConnectionName')]",
53-
"customParameterValues": {},
5447
"api": {
5548
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azureloganalyticsdatacollector')]"
5649
}
@@ -75,7 +68,6 @@
7568
"kind": "V1",
7669
"properties": {
7770
"displayName": "[parameters('PlaybookName')]",
78-
"customParameterValues": {},
7971
"parameterValueType": "Alternative",
8072
"api": {
8173
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
@@ -174,7 +166,7 @@
174166
"inputs": {
175167
"body": {
176168
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
177-
"message": "<p>Virus Total File Report found for @{items('For_each')?['Url']}<br>\nReputation is: @{body('Get_Domain_report')?['data']?['attributes']?['reputation']}which indicates likely harmless<br>\nQuery: VTURLReport_CL | where id_s == \"@{items('For_each')?['Url']}\"</p>"
169+
"message": "<p>Virus Total File Report found for @{items('For_each')?['Url']}<br>\nReputation is: @{body('Get_Domain_report')?['data']?['attributes']?['reputation']} which indicates likely harmless domain.<br>\nQuery: VTURLReport_CL | where id_s == \"@{items('For_each')?['Url']}\"</p>"
178170
},
179171
"host": {
180172
"connection": {
@@ -221,7 +213,7 @@
221213
"inputs": {
222214
"body": {
223215
"incidentArmId": "@body('Alert_-_Get_incident')?['id']",
224-
"message": "<p>Virus Total File Report found for @{items('For_each')?['Url']}<br>\nReputation is: @{body('Get_Domain_report')?['data']?['attributes']?['reputation']}which indicates likely malicous<br>\nQuery: VTURLReport_CL | where id_s == \"@{items('For_each')?['Url']}\"</p>"
216+
"message": "<p>Virus Total File Report found for @{items('For_each')?['Url']}<br>\nReputation is: @{body('Get_Domain_report')?['data']?['attributes']?['reputation']} which indicates likely malicious domain.<br>\nQuery: VTURLReport_CL | where id_s == \"@{items('For_each')?['Url']}\"</p>"
225217
},
226218
"host": {
227219
"connection": {
@@ -274,7 +266,7 @@
274266
}
275267
},
276268
"method": "get",
277-
"path": "/api/v3/domains/@{encodeURIComponent(split(items('For_each')?['Url'], '/')[2])}"
269+
"path": "/api/v3/domains/@{encodeURIComponent(if(greater(length(split(items('For_each')?['Url'], '/')), 2), split(items('For_each')?['Url'], '/')[2], items('For_each')?['Url']))}"
278270
}
279271
}
280272
},

‎Solutions/VirusTotal/Playbooks/Get-VirusTotalDomainReport/incident-trigger/azuredeploy.json‎

Lines changed: 17 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -2,28 +2,24 @@
22
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
33
"contentVersion": "1.0.0.0",
44
"metadata": {
5-
"title": "URL Enrichment - Virus Total domain report - Incident Triggered",
5+
"title": "URL Enrichment - Virus Total Domain Report - Incident Triggered",
66
"description": "This playbook will take each URL entity and query VirusTotal for Domain Report (https://developers.virustotal.com/v3.0/reference#domain-info). It will write the results to Log Analytics and add a comment to the incident.",
7-
"prerequisites": [ "Register to Virus Total community for an API key." ],
8-
"postDeployment": [ "After deployment, attach this playbook to an **automation rule** so it runs when the incident is created." ],
9-
"lastUpdateTime": "2022-07-20T00:00:00.000Z",
7+
"prerequisites": [ "VirusTotal API key, Register to VirusTotal community. [Register here](https://www.virustotal.com/gui/join-us)" ],
8+
"postDeployment": [
9+
"1. Authorize/Configure all the connections.",
10+
"2. Assign Microsoft Sentinel Responder Role to playbook.",
11+
"3. After deployment, attach this playbook to an **automation rule** and map URL entity so it runs when the incident is created.",
12+
"[click here for detail instructions](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VirusTotal/Playbooks/Get-VirusTotalDomainReport/readme.md)"
13+
],
14+
"lastUpdateTime": "2025-05-28T00:00:00.000Z",
1015
"entities": [ "URL" ],
1116
"tags": [ "Enrichment" ],
1217
"support": {
1318
"tier": "Community"
1419
},
1520
"author": {
1621
"name": "Nicholas DiCola"
17-
},
18-
"releaseNotes": [
19-
{
20-
"version": "1.0.0",
21-
"title": "URL Enrichment - Virus Total domain report",
22-
"notes": [
23-
"Initial version"
24-
]
25-
}
26-
]
22+
}
2723
},
2824
"parameters": {
2925
"PlaybookName": {
@@ -32,9 +28,9 @@
3228
}
3329
},
3430
"variables": {
35-
"AzureLogAnalyticsDataCollectorConnectionName": "[concat('azureloganalyticsdatacollector-', parameters('PlaybookName'))]",
36-
"AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]",
37-
"VirusTotalConnectionName": "[concat('virustotal-',parameters('PlaybookName'))]"
31+
"AzureLogAnalyticsDataCollectorConnectionName": "[concat('AzureLogAnalyticsDataCollector-', parameters('PlaybookName'))]",
32+
"AzureSentinelConnectionName": "[concat('MicrosoftSentinel-', parameters('PlaybookName'))]",
33+
"VirusTotalConnectionName": "[concat('VirusTotal-',parameters('PlaybookName'))]"
3834
},
3935
"resources": [
4036
{
@@ -44,7 +40,6 @@
4440
"location": "[resourceGroup().location]",
4541
"properties": {
4642
"displayName": "[variables('AzureLogAnalyticsDataCollectorConnectionName')]",
47-
"customParameterValues": {},
4843
"api": {
4944
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azureloganalyticsdatacollector')]"
5045
}
@@ -69,7 +64,6 @@
6964
"kind": "V1",
7065
"properties": {
7166
"displayName": "[parameters('PlaybookName')]",
72-
"customParameterValues": {},
7367
"parameterValueType": "Alternative",
7468
"api": {
7569
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
@@ -121,7 +115,7 @@
121115
"inputs": {
122116
"body": {
123117
"incidentArmId": "@triggerBody()?['object']?['id']",
124-
"message": "<p>Virus Total File Report found for @{items('For_each')?['Url']}<br>\nReputation is: @{body('Get_Domain_report')?['data']?['attributes']?['reputation']}which indicates likely harmless<br>\nQuery: VTURLReport_CL | where id_s == \"@{items('For_each')?['Url']}\"</p>"
118+
"message": "<p>Virus Total File Report found for @{items('For_each')?['Url']}<br>\nReputation is: @{body('Get_Domain_report')?['data']?['attributes']?['reputation']} which indicates likely harmless domain.<br>\nQuery: VTURLReport_CL | where id_s == \"@{items('For_each')?['Url']}\"</p>"
125119
},
126120
"host": {
127121
"connection": {
@@ -163,7 +157,7 @@
163157
"inputs": {
164158
"body": {
165159
"incidentArmId": "@triggerBody()?['object']?['id']",
166-
"message": "<p>Virus Total File Report found for @{items('For_each')?['Url']}<br>\nReputation is: @{body('Get_Domain_report')?['data']?['attributes']?['reputation']}which indicates likely malicous<br>\nQuery: VTURLReport_CL | where id_s == \"@{items('For_each')?['Url']}\"</p>"
160+
"message": "<p>Virus Total File Report found for @{items('For_each')?['Url']}<br>\nReputation is: @{body('Get_Domain_report')?['data']?['attributes']?['reputation']} which indicates likely malicious domain.<br>\nQuery: VTURLReport_CL | where id_s == \"@{items('For_each')?['Url']}\"</p>"
167161
},
168162
"host": {
169163
"connection": {
@@ -225,7 +219,7 @@
225219
}
226220
},
227221
"method": "get",
228-
"path": "/api/v3/domains/@{encodeURIComponent(split(items('For_each')?['Url'], '/')[2])}"
222+
"path": "/api/v3/domains/@{encodeURIComponent(if(greater(length(split(items('For_each')?['Url'], '/')), 2), split(items('For_each')?['Url'], '/')[2], items('For_each')?['Url']))}"
229223
},
230224
"runAfter": {},
231225
"type": "ApiConnection"
@@ -270,7 +264,7 @@
270264
"value": {
271265
"azureloganalyticsdatacollector": {
272266
"connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureLogAnalyticsDataCollectorConnectionName'))]",
273-
"connectionName": "[variables('AzureSentinelConnectionName')]",
267+
"connectionName": "[variables('AzureLogAnalyticsDataCollectorConnectionName')]",
274268
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azureloganalyticsdatacollector')]"
275269
},
276270
"azuresentinel": {

0 commit comments

Comments
 (0)