Skip to content

Commit d16e952

Browse files
mazamizo21claude
mazamizo21
and
claude
committed
Solution: TacitRed IOC CrowdStrike Automation (Official)
This solution provides example playbooks that demonstrate how to consume TacitRed threat intelligence from Microsoft Sentinel and prepare indicators for ingestion into CrowdStrike. Key features: - Playbook for automated IOC export to CrowdStrike - Integration with TacitRed threat intelligence feed - V3 package artifacts - Comprehensive setup documentation Changes: - Add tacitred_logo.svg to top-level Logos/ directory - Solution files with correct logo format (no spaces between attributes) - Playbook templates and configuration Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
1 parent b424059 commit d16e952

12 files changed

+309
-36
lines changed

‎Logos/tacitred_logo.svg‎

Lines changed: 5 additions & 0 deletions
Loading

‎Solutions/TacitRed-IOC-CrowdStrike/Data/Solution_TacitRedCrowdStrikeAutomation.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"Name": "TacitRed-IOC-CrowdStrike",
3+
"Author": "Data443 Risk Mitigation, Inc. - support@data443.com",
4+
"Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/tacitred_logo.svg\"width=\"75px\"height=\"75px\">",
5+
"Description": "The TacitRed CrowdStrike IOC Automation solution provides example playbooks that demonstrate how to consume TacitRed threat intelligence from Microsoft Sentinel and prepare indicators for ingestion into CrowdStrike.",
6+
"Playbooks": [
7+
"Playbooks/TacitRedToCrowdStrike_Playbook.json"
8+
],
9+
"Metadata": "SolutionMetadata.json",
10+
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\TacitRed-IOC-CrowdStrike",
11+
"Version": "3.0.0",
12+
"TemplateSpec": true,
13+
"Is1Pconnector": false
14+
}

‎Solutions/TacitRed-IOC-CrowdStrike/Package/3.0.0.zip‎

5.24 KB
Binary file not shown.

‎Solutions/TacitRed-IOC-CrowdStrike/Package/createUiDefinition.json‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"config": {
77
"isWizard": false,
88
"basics": {
9-
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\"width=\"75px\"height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/TacitRed-IOC-CrowdStrike/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe TacitRed CrowdStrike IOC Automation solution provides example playbooks that demonstrate how to consume TacitRed threat intelligence from Microsoft Sentinel and prepare indicators for ingestion into CrowdStrike.\n\n**Playbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
9+
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Workbooks/Images/Logos/tacitred_logo.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/TacitRed-IOC-CrowdStrike/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe TacitRed CrowdStrike IOC Automation solution provides example playbooks that demonstrate how to consume TacitRed threat intelligence from Microsoft Sentinel and prepare indicators for ingestion into CrowdStrike.\n\n**Playbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
1010
"subscription": {
1111
"resourceProviders": [
1212
"Microsoft.OperationsManagement/solutions",
@@ -73,7 +73,7 @@
7373
"options": {
7474
"link": {
7575
"label": "Learn more",
76-
"uri": "https://docs.microsoft.com/azure/sentinel/tutorial-respond-threats-playbook?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef"
76+
"uri": "https://learn.microsoft.com/azure/sentinel/tutorial-respond-threats-playbook?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef"
7777
}
7878
}
7979
}
@@ -87,3 +87,4 @@
8787
}
8888
}
8989
}
90+

‎Solutions/TacitRed-IOC-CrowdStrike/Package/mainTemplate.json‎

Lines changed: 24 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
33
"contentVersion": "1.0.0.0",
44
"metadata": {
5-
"author": "Data443 Risk Mitigation, Inc. - support@data443.com",
5+
"author": "TacitRed - support@data443.com",
66
"comments": "Solution template for TacitRed-IOC-CrowdStrike"
77
},
88
"parameters": {
@@ -33,15 +33,14 @@
3333
"email": "support@data443.com",
3434
"_email": "[variables('email')]",
3535
"_solutionName": "TacitRed-IOC-CrowdStrike",
36-
"_solutionVersion": "3.0.4",
37-
"solutionId": "tacitred.azure-sentinel-solution-tacitred-crowdstrike-ioc-automation",
36+
"_solutionVersion": "3.0.0",
37+
"solutionId": "data443.azure-sentinel-solution-tacitred-crowdstrike-ioc-automation",
3838
"_solutionId": "[variables('solutionId')]",
39-
"_tacitRedFindingsQuery": "[concat('?types[]=compromised_credentials', if(empty(parameters('TacitRed_Domain')), '', concat('&domains[]=', uriComponent(parameters('TacitRed_Domain')))), '&page=1&page_size=100')]",
4039
"Playbooks": "Playbooks",
4140
"_Playbooks": "[variables('Playbooks')]",
4241
"blanks": "[replace('b', 'b', '')]",
4342
"playbookVersion1": "1.0",
44-
"playbookContentId1": "Playbooks",
43+
"playbookContentId1": "TacitRedToCrowdStrike",
4544
"_playbookContentId1": "[variables('playbookContentId1')]",
4645
"playbookId1": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId1'))]",
4746
"playbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId1'))))]",
@@ -52,14 +51,14 @@
5251
"resources": [
5352
{
5453
"type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
55-
"apiVersion": "2023-04-01-preview",
54+
"apiVersion": "2025-09-01",
5655
"name": "[variables('playbookTemplateSpecName1')]",
5756
"location": "[parameters('workspace-location')]",
5857
"dependsOn": [
5958
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
6059
],
6160
"properties": {
62-
"description": "Playbooks Playbook with template version 3.0.0",
61+
"description": "TacitRed to CrowdStrike IOC Automation Playbook with template version 3.0.0",
6362
"mainTemplate": {
6463
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
6564
"contentVersion": "[variables('playbookVersion1')]",
@@ -69,7 +68,8 @@
6968
"defaultValue": "pb-tacitred-to-crowdstrike"
7069
},
7170
"location": {
72-
"type": "string"
71+
"type": "string",
72+
"defaultValue": "[concat('[resourceGroup().locatio', 'n]')]"
7373
},
7474
"TacitRed_ApiKey": {
7575
"type": "securestring",
@@ -120,9 +120,6 @@
120120
"TacitRed_Domain": {
121121
"value": "[[parameters('TacitRed_Domain')]"
122122
},
123-
"TacitRed_FindingsQuery": {
124-
"value": "[[variables('_tacitRedFindingsQuery')]"
125-
},
126123
"CrowdStrike_ClientId": {
127124
"value": "[[parameters('CrowdStrike_ClientId')]"
128125
},
@@ -146,10 +143,6 @@
146143
"type": "string",
147144
"defaultValue": "[variables('blanks')]"
148145
},
149-
"TacitRed_FindingsQuery": {
150-
"type": "string",
151-
"defaultValue": "[variables('blanks')]"
152-
},
153146
"CrowdStrike_BaseUrl": {
154147
"type": "string",
155148
"defaultValue": "https://api.us-2.crowdstrike.com"
@@ -186,7 +179,7 @@
186179
"type": "Http",
187180
"inputs": {
188181
"method": "GET",
189-
"uri": "@{parameters('TacitRed_ApiUrl')}@{parameters('TacitRed_FindingsQuery')}",
182+
"uri": "@{parameters('TacitRed_ApiUrl')}?types[]=compromised_credentials&domains[]=@{encodeUriComponent(if(empty(parameters('TacitRed_Domain')),'',parameters('TacitRed_Domain')))}&page=1&page_size=50",
190183
"headers": {
191184
"accept": "application/json",
192185
"Authorization": "@{parameters('TacitRed_ApiKey')}"
@@ -225,7 +218,7 @@
225218
"uri": "@{parameters('CrowdStrike_BaseUrl')}@{parameters('CrowdStrike_IocPath')}?ignore_warnings=true",
226219
"headers": {
227220
"Content-Type": "application/json",
228-
"Authorization": "@{concat('Bearer ', body('Get_CrowdStrike_Token')?['access_token'])}"
221+
"Authorization": "Bearer @{body('Get_CrowdStrike_Token')?['access_token']}"
229222
},
230223
"body": {
231224
"indicators": [
@@ -263,7 +256,7 @@
263256
},
264257
{
265258
"type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
266-
"apiVersion": "2022-01-01-preview",
259+
"apiVersion": "2025-09-01",
267260
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId1'),'/'))))]",
268261
"properties": {
269262
"parentId": "[variables('playbookId1')]",
@@ -276,7 +269,7 @@
276269
"sourceId": "[variables('_solutionId')]"
277270
},
278271
"author": {
279-
"name": "Data443 Risk Mitigation, Inc.",
272+
"name": "TacitRed",
280273
"email": "[variables('_email')]"
281274
},
282275
"support": {
@@ -296,25 +289,27 @@
296289
"contentSchemaVersion": "3.0.0",
297290
"contentId": "[variables('_playbookContentId1')]",
298291
"contentKind": "Playbook",
299-
"displayName": "Playbooks",
292+
"displayName": "TacitRed to CrowdStrike IOC Automation",
300293
"contentProductId": "[variables('_playbookcontentProductId1')]",
294+
"id": "[variables('_playbookcontentProductId1')]",
301295
"version": "[variables('playbookVersion1')]"
302296
}
303297
},
304298
{
305299
"type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages",
306-
"apiVersion": "2023-04-01-preview",
300+
"apiVersion": "2025-09-01",
307301
"location": "[parameters('workspace-location')]",
308302
"properties": {
309-
"version": "3.0.3",
303+
"version": "3.0.0",
310304
"kind": "Solution",
311305
"contentSchemaVersion": "3.0.0",
312306
"displayName": "TacitRed-IOC-CrowdStrike",
313-
"publisherDisplayName": "TacitRed",
314-
"descriptionHtml": "<p><strong>Note:</strong> Please refer to the following before installing the solution:</p>\n<p>• Review the solution <a href=\"https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/TacitRed-IOC-CrowdStrike/ReleaseNotes.md\">Release Notes</a></p>\n<p>• There may be <a href=\"https://aka.ms/sentinelsolutionsknownissues\">known issues</a> pertaining to this Solution, please refer to them before installing.</p>\n<p>The TacitRed CrowdStrike IOC Automation solution provides example playbooks that demonstrate how to consume TacitRed threat intelligence from Microsoft Sentinel and prepare indicators for ingestion into CrowdStrike.</p>\n<p><strong>Playbooks:</strong> 1</p>\n<p><a href=\"https://aka.ms/azuresentinel\">Learn more about Microsoft Sentinel</a> | <a href=\"https://aka.ms/azuresentinelsolutionsdoc\">Learn more about Solutions</a></p>\n",
307+
"publisherDisplayName": "Data443 Risk Mitigation, Inc.",
308+
"descriptionHtml": "<p><strong>Note:</strong> Please refer to the following before installing the solution:</p>\n<p>&#8226; Review the solution <a href=\"https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/TacitRed-IOC-CrowdStrike/ReleaseNotes.md\">Release Notes</a></p>\n<p>&#8226; There may be <a href=\"https://aka.ms/sentinelsolutionsknownissues\">known issues</a> pertaining to this Solution, please refer to them before installing.</p>\n<p>The TacitRed CrowdStrike IOC Automation solution provides example playbooks that demonstrate how to consume TacitRed threat intelligence from Microsoft Sentinel and prepare indicators for ingestion into CrowdStrike.</p>\n<p><strong>Playbooks:</strong> 1</p>\n<p><a href=\"https://aka.ms/azuresentinel\">Learn more about Microsoft Sentinel</a> | <a href=\"https://aka.ms/azuresentinelsolutionsdoc\">Learn more about Solutions</a></p>\n",
315309
"contentKind": "Solution",
316310
"contentProductId": "[variables('_solutioncontentProductId')]",
317-
"icon": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\"width=\"75px\"height=\"75px\">",
311+
"id": "[variables('_solutioncontentProductId')]",
312+
"icon": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Workbooks/Images/Logos/tacitred_logo.svg\" width=\"75px\" height=\"75px\">",
318313
"contentId": "[variables('_solutionId')]",
319314
"parentId": "[variables('_solutionId')]",
320315
"source": {
@@ -323,7 +318,7 @@
323318
"sourceId": "[variables('_solutionId')]"
324319
},
325320
"author": {
326-
"name": "Data443 Risk Mitigation, Inc.",
321+
"name": "TacitRed",
327322
"email": "[variables('_email')]"
328323
},
329324
"support": {
@@ -337,14 +332,14 @@
337332
"criteria": [
338333
{
339334
"kind": "Playbook",
340-
"contentId": "[variables('_Playbooks')]",
335+
"contentId": "[variables('_playbookContentId1')]",
341336
"version": "[variables('playbookVersion1')]"
342337
}
343338
]
344339
},
345340
"firstPublishDate": "2025-11-25",
346341
"providers": [
347-
"TacitRed"
342+
"Data443 Risk Mitigation, Inc."
348343
],
349344
"categories": {
350345
"domains": [
@@ -356,4 +351,4 @@
356351
}
357352
],
358353
"outputs": {}
359-
}
354+
}

‎Solutions/TacitRed-IOC-CrowdStrike/Playbooks/Images/TacitRedToCrowdStrikeDark.png‎

496 KB
Loading

‎Solutions/TacitRed-IOC-CrowdStrike/Playbooks/Images/TacitRedToCrowdStrikeLight.png‎

500 KB
Loading

0 commit comments

Comments
 (0)