Note: There may be known issues pertaining to this Solution, please refer to them before installing.
\nAWS Systems Manager is the operations hub for your AWS applications and resources and a secure end-to-end management solution for hybrid and multicloud environments that enables secure operations at scale. This solution helps to enhance your SOAR capabilities by integrating Sentinel with AWS manager.
\nFunction Apps: 1, Playbooks: 7
\nLearn more about Microsoft Sentinel | Learn more about Solutions
\n", + "descriptionHtml": "Note: Please refer to the following before installing the solution:
\n• Review the solution Release Notes
\n• There may be known issues pertaining to this Solution, please refer to them before installing.
\nAWS Systems Manager is the operations hub for your AWS applications and resources and a secure end-to-end management solution for hybrid and multicloud environments that enables secure operations at scale. This solution helps to enhance your SOAR capabilities by integrating Sentinel with AWS manager.
\nFunction Apps: 1, Playbooks: 7
\nLearn more about Microsoft Sentinel | Learn more about Solutions
\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", diff --git a/Solutions/AWS Systems Manager/Playbooks/AWSSystemsManagerPlaybooks/AWS-SSM-GetInstancePatches/azuredeploy.json b/Solutions/AWS Systems Manager/Playbooks/AWSSystemsManagerPlaybooks/AWS-SSM-GetInstancePatches/azuredeploy.json index 1b12eaf9739..c60e7a966da 100644 --- a/Solutions/AWS Systems Manager/Playbooks/AWSSystemsManagerPlaybooks/AWS-SSM-GetInstancePatches/azuredeploy.json +++ b/Solutions/AWS Systems Manager/Playbooks/AWSSystemsManagerPlaybooks/AWS-SSM-GetInstancePatches/azuredeploy.json @@ -13,8 +13,7 @@ "2. Configure Playbook in Microsoft Sentinel Analytic Rule.", "3. Assign Microsoft Sentinel Responder Role to Playbook.", "4. Update Function App Settings with AWS Credentials.", - "5. Check readme.md for detailed instructions." - + "5. Check readme.md for detailed instructions." ], "prerequisitesDeployTemplateFile": "../../CustomConnector/AWS_SSM_FunctionAppConnector/azuredeploy.json", "lastUpdateTime": "2023-05-30T12:00:00.000Z", @@ -58,8 +57,7 @@ "contentVersion": "1.0.0.0", "parameters": { "$connections": { - "defaultValue": { - }, + "defaultValue": {}, "type": "Object" } }, @@ -154,8 +152,7 @@ } }, "DescribeInstancePatches": { - "runAfter": { - }, + "runAfter": {}, "type": "Function", "inputs": { "body": { @@ -224,8 +221,7 @@ } } }, - "runAfter": { - }, + "runAfter": {}, "type": "Foreach" } }, @@ -240,8 +236,7 @@ "else": { "actions": { "Append_to_IncidentComment": { - "runAfter": { - }, + "runAfter": {}, "type": "AppendToStringVariable", "inputs": { "name": "IncidentComment", @@ -263,8 +258,7 @@ "type": "If" }, "Entities_-_Get_Hosts": { - "runAfter": { - }, + "runAfter": {}, "type": "ApiConnection", "inputs": { "body": "@triggerBody()?['object']?['properties']?['relatedEntities']", @@ -296,7 +290,7 @@ } }, "For_each_AWS_Instance_get_hostname_and_private_ip": { - "foreach": "@body('Parse_JSON_-_GetInventory')?['Entities']", + "foreach": "@body('Parse_JSON_-_GetInventory')?['value']", "actions": { "For_each_Instance_Entity": { "foreach": "@items('For_each_AWS_Instance_get_hostname_and_private_ip')['Data']['AWS:InstanceInformation']['Content']", @@ -328,8 +322,7 @@ } }, "Compose_InstanceId_Hostname_Pair": { - "runAfter": { - }, + "runAfter": {}, "type": "Compose", "inputs": { "Hostname": "@items('For_each_Instance_Entity')?['ComputerName']", @@ -349,8 +342,7 @@ } } }, - "runAfter": { - }, + "runAfter": {}, "expression": { "and": [ { @@ -366,8 +358,7 @@ "type": "If" } }, - "runAfter": { - }, + "runAfter": {}, "type": "Foreach" } }, @@ -387,8 +378,7 @@ "Condition_if_incident_Hostname_matches_AWS_EC2_hostname": { "actions": { "Append_to_array_-_InstanceIdList": { - "runAfter": { - }, + "runAfter": {}, "type": "AppendToArrayVariable", "inputs": { "name": "InstanceIdList", @@ -396,8 +386,7 @@ } } }, - "runAfter": { - }, + "runAfter": {}, "expression": { "and": [ { @@ -411,8 +400,7 @@ "type": "If" } }, - "runAfter": { - }, + "runAfter": {}, "type": "Foreach" } }, @@ -432,8 +420,7 @@ "Condition_If_IP_matches_with_PrivateIP": { "actions": { "Append_to_array_variable_InstanceIdList": { - "runAfter": { - }, + "runAfter": {}, "type": "AppendToArrayVariable", "inputs": { "name": "InstanceIdList", @@ -441,8 +428,7 @@ } } }, - "runAfter": { - }, + "runAfter": {}, "expression": { "and": [ { @@ -456,8 +442,7 @@ "type": "If" } }, - "runAfter": { - }, + "runAfter": {}, "type": "Foreach" } }, @@ -555,120 +540,145 @@ "inputs": { "content": "@body('GetInventory')", "schema": { + "type": "object", "properties": { - "Entities": { + "value": { + "type": "array", "items": { + "type": "object", "properties": { + "Id": { + "type": "string" + }, "Data": { + "type": "object", "properties": { "AWS:InstanceInformation": { + "type": "object", "properties": { + "TypeName": { + "type": "string" + }, + "SchemaVersion": { + "type": "string" + }, "CaptureTime": { "type": "string" }, "Content": { + "type": "array", "items": { + "type": "object", "properties": { - "AgentType": { + "InstanceId": { "type": "string" }, - "AgentVersion": { + "InstanceStatus": { "type": "string" }, - "ComputerName": { - "type": "string" + "AgentType": { + "type": [ + "string", + "null" + ] }, - "InstanceId": { - "type": "string" + "AgentVersion": { + "type": [ + "string", + "null" + ] }, - "InstanceStatus": { - "type": "string" + "ComputerName": { + "type": [ + "string", + "null" + ] }, "IpAddress": { - "type": "string" + "type": [ + "string", + "null" + ] }, "PlatformName": { - "type": "string" + "type": [ + "string", + "null" + ] }, "PlatformType": { - "type": "string" + "type": [ + "string", + "null" + ] }, "PlatformVersion": { - "type": "string" + "type": [ + "string", + "null" + ] }, "ResourceType": { - "type": "string" + "type": [ + "string", + "null" + ] } }, - "type": "object" - }, - "type": "array" - }, - "SchemaVersion": { - "type": "string" - }, - "TypeName": { - "type": "string" + "required": [ + "InstanceId", + "InstanceStatus" + ] + } } }, - "type": "object" + "required": [ + "TypeName", + "SchemaVersion", + "CaptureTime", + "Content" + ] } }, - "type": "object" - }, - "Id": { - "type": "string" + "required": [ + "AWS:InstanceInformation" + ] } }, - "type": "object" - }, - "type": "array" + "required": [ + "Id", + "Data" + ] + } }, - "ResponseMetadata": { - "properties": { - "HTTPHeaders": { - "properties": { - "connection": { - "type": "string" - }, - "content-length": { - "type": "string" - }, - "content-type": { - "type": "string" - }, - "date": { - "type": "string" - }, - "server": { - "type": "string" - }, - "x-amzn-requestid": { - "type": "string" - } - }, - "type": "object" - }, - "HTTPStatusCode": { - "type": "integer" - }, - "RequestId": { - "type": "string" - }, - "RetryAttempts": { - "type": "integer" - } - }, - "type": "object" + "nextLink": { + "type": [ + "string", + "null" + ] } }, - "type": "object" + "required": [ + "value", + "nextLink" + ] } } + }, + "Filter_value_with_empty_Data_and_Content": { + "runAfter": { + "Parse_JSON_-_GetInventory": [ + "Succeeded" + ] + }, + "type": "Query", + "inputs": { + "from": "@body('Parse_JSON_-_GetInventory')['value']", + "where": "@and(\n not(empty(item()?['Data']?['AWS:InstanceInformation']?['Content'])),\n not(empty(item()?['Data']?['AWS:InstanceInformation']?['Content']?[0]?['InstanceId']))\n)\n" + } } }, - "outputs": { - } + "outputs": {} }, "parameters": { "$connections": { @@ -710,8 +720,7 @@ "kind": "V1", "properties": { "displayName": "[variables('MicrosoftSentinelConnectionName')]", - "customParameterValues": { - }, + "customParameterValues": {}, "parameterValueType": "Alternative", "api": { "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/Azuresentinel')]" @@ -719,4 +728,4 @@ } } ] -} +} \ No newline at end of file diff --git a/Solutions/AWS Systems Manager/Playbooks/AWSSystemsManagerPlaybooks/AWS-SSM-GetInstancePatches/image.png b/Solutions/AWS Systems Manager/Playbooks/AWSSystemsManagerPlaybooks/AWS-SSM-GetInstancePatches/image.png new file mode 100644 index 00000000000..fb76a2e6f0c Binary files /dev/null and b/Solutions/AWS Systems Manager/Playbooks/AWSSystemsManagerPlaybooks/AWS-SSM-GetInstancePatches/image.png differ diff --git a/Solutions/AWS Systems Manager/Playbooks/AWSSystemsManagerPlaybooks/AWS-SSM-GetInstancePatches/readme.md b/Solutions/AWS Systems Manager/Playbooks/AWSSystemsManagerPlaybooks/AWS-SSM-GetInstancePatches/readme.md index caef111aac5..553b0f01ced 100644 --- a/Solutions/AWS Systems Manager/Playbooks/AWSSystemsManagerPlaybooks/AWS-SSM-GetInstancePatches/readme.md +++ b/Solutions/AWS Systems Manager/Playbooks/AWSSystemsManagerPlaybooks/AWS-SSM-GetInstancePatches/readme.md @@ -58,6 +58,11 @@ Once deployment is complete, authorize each connection. #### d. Function App Settings Update Instructions Refer to [AWS Systems Manager API Function App Connector](../../CustomConnector/AWS_SSM_FunctionAppConnector/readme.md) documentation for Function App **Application Settings (Access Key ID, Secret Access Key and Region)** update instruction. +#### e. Additional instruction while playbook configuration: +When configuring the playbook, ensure that pagination is disabled for GetInventory, as pagination is already handled by the connector. + + + # References - [AWS Systems Manager API Documentation](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeleteDocument.html) - [AWS Systems Manager User Guide](https://docs.aws.amazon.com/systems-manager/latest/userguide/what-is-systems-manager.html) diff --git a/Solutions/AWS Systems Manager/Playbooks/CustomConnector/AWS_SSM_FunctionAppConnector/AWSSSMFunctionsApp.zip b/Solutions/AWS Systems Manager/Playbooks/CustomConnector/AWS_SSM_FunctionAppConnector/AWSSSMFunctionsApp.zip index 72c2317463f..bf342c25a3e 100644 Binary files a/Solutions/AWS Systems Manager/Playbooks/CustomConnector/AWS_SSM_FunctionAppConnector/AWSSSMFunctionsApp.zip and b/Solutions/AWS Systems Manager/Playbooks/CustomConnector/AWS_SSM_FunctionAppConnector/AWSSSMFunctionsApp.zip differ diff --git a/Solutions/AWS Systems Manager/Playbooks/CustomConnector/AWS_SSM_FunctionAppConnector/GetInventory/__init__.py b/Solutions/AWS Systems Manager/Playbooks/CustomConnector/AWS_SSM_FunctionAppConnector/GetInventory/__init__.py index 159468c7e5b..f231edfb7d4 100644 --- a/Solutions/AWS Systems Manager/Playbooks/CustomConnector/AWS_SSM_FunctionAppConnector/GetInventory/__init__.py +++ b/Solutions/AWS Systems Manager/Playbooks/CustomConnector/AWS_SSM_FunctionAppConnector/GetInventory/__init__.py @@ -39,7 +39,7 @@ def main(req: func.HttpRequest) -> func.HttpResponse: if not (filters and aggregators and result_attributes and next_token and max_results): try: - req_body = json.loads(req.get_json()) + req_body = req.get_json() except ValueError: pass else: @@ -49,6 +49,7 @@ def main(req: func.HttpRequest) -> func.HttpResponse: next_token = req_body.get('NextToken') max_results = req_body.get('MaxResults') + logging.info(f'Parsed Parameters - Filters: {filters}, Aggregators: {aggregators}, ResultAttributes: {result_attributes}, MaxResults: {max_results}') # Set parameter dictionary based on the request parameters kwargs = {} if filters: @@ -58,7 +59,7 @@ def main(req: func.HttpRequest) -> func.HttpResponse: if result_attributes: kwargs['DocumentVersion'] = result_attributes if next_token: - kwargs['DocumentFormat'] = next_token + kwargs['NextToken'] = next_token if max_results: kwargs['MaxResults'] = max_results @@ -72,18 +73,41 @@ def main(req: func.HttpRequest) -> func.HttpResponse: ) try: - logging.info('Calling function to get AWS SSM Inventory.') + logging.info('Pagination handling.') + + all_entities = [] + next_token = kwargs.get('NextToken') + while True: + if next_token: + kwargs['NextToken'] = next_token + else: + kwargs.pop('NextToken', None) + + logging.info('Calling function to get AWS SSM Inventory.') + + results = ssm_client.get_inventory(**kwargs) + + logging.info('Call to get AWS SSM Inventory successful.') - results = ssm_client.get_inventory(**kwargs) + all_entities.extend(results.get("Entities", [])) + + next_token = results.get("NextToken") + if not next_token: + break + + logging.info('Pagination handling completed.') - logging.info('Call to get AWS SSM Inventory successful.') + base_url = req.url.split('?')[0] - # Return the results + response = { + "value": all_entities, + "nextLink": None + } return func.HttpResponse( - json.dumps(results), - headers = {"Content-Type": "application/json"}, - status_code = 200 - ) + json.dumps(response), + headers={"Content-Type": "application/json"}, + status_code=200 + ) except ssm_client.exceptions.InternalServerError as ex: logging.error(f"Internal Server Exception: {str(ex)}") @@ -120,4 +144,4 @@ def main(req: func.HttpRequest) -> func.HttpResponse: except Exception as ex: logging.error(f"Exception Occured: {str(ex)}") - return func.HttpResponse("Internal Server Exception", status_code=500) + return func.HttpResponse("Internal Server Exception", status_code=500) \ No newline at end of file diff --git a/Solutions/AWS Systems Manager/ReleaseNotes.md b/Solutions/AWS Systems Manager/ReleaseNotes.md index 08bae7252cb..e9c6b4a66db 100644 --- a/Solutions/AWS Systems Manager/ReleaseNotes.md +++ b/Solutions/AWS Systems Manager/ReleaseNotes.md @@ -1,4 +1,5 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------------------------------------| +| 3.0.2 | 01-14-2026 | Fixed AWS-SSM-GetInstancePatches Playbook and updated Function App pagination | | 3.0.1 | 29-01-2024 | App insights to LA change in data connector and repackage |