Skip to content

Commit 1a01136

Browse files
cyble-devcyble-dev
authored
Merge pull request #4 from prince30121/bugfix/added-missing-param-definitions
Bugfix/added missing param definitions
2 parents 76bf77e + 467b5c7 commit 1a01136

File tree

7 files changed

+120
-19
lines changed

7 files changed

+120
-19
lines changed

‎Logos/CybleLogo.svg‎

Lines changed: 18 additions & 0 deletions
Loading

‎Solutions/Cyble Vision/Data/Solution_CybleVision.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,11 @@
11
{
22
"Name": "Cyble Vision",
33
"Author": "Cyble Inc",
4+
<<<<<<< Updated upstream
45
"Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">",
6+
=======
7+
"Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/CybleLogo.svg\" width=\"75px\" height=\"75px\">",
8+
>>>>>>> Stashed changes
59
"Description": "This solution provides playbooks for Cyble Vision Threat Intelligence ingestion and IOC enrichment, integrating Cyble APIs with Microsoft Sentinel.",
610
"Playbooks": [
711
"Solutions/Cyble Vision/Playbooks/IoC-Enrichment/Cyble_IOC_Enrichment.json",

‎Solutions/Cyble Vision/Package/1.0.0.zip‎

-633 Bytes
Binary file not shown.

‎Solutions/Cyble Vision/Package/mainTemplate.json‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -20,20 +20,6 @@
2020
"metadata": {
2121
"description": "Cyble API Key for authentication"
2222
}
23-
},
24-
"iocEnrichmentDefinition": {
25-
"type": "object",
26-
"defaultValue": {},
27-
"metadata": {
28-
"description": "Definition for the Cyble IOC Enrichment playbook"
29-
}
30-
},
31-
"threatIntelDefinition": {
32-
"type": "object",
33-
"defaultValue": {},
34-
"metadata": {
35-
"description": "Definition for the Cyble Threat Intelligence Ingestion playbook"
36-
}
3723
}
3824
},
3925
"resources": [

‎Solutions/Cyble Vision/Playbooks/IoC-Enrichment/Cyble_IOC_Enrichment.json‎

Lines changed: 40 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,34 @@
22
"definition": {
33
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
44
"contentVersion": "1.0.0.0",
5+
"metadata": {
6+
"title": "Cyble-IOC_Enrichment",
7+
"description": "This playbook leverages the Cyble API to enrich IP, Domain, Url & Hash indicators, found in Microsoft Sentinel incidents, with the following context: Risk Score, Confidence, etc. The enrichment content will be posted as a comment in the Microsoft Sentinel incident",
8+
"prerequisites": [
9+
"To use the Cyble Endpoints for Azure connector, you will need a valid API token from Cyble Vision platform."
10+
],
11+
"prerequisitesDeployTemplateFile": "",
12+
"lastUpdateTime": "2025-05-06T00:00:00.000Z",
13+
"entities": [
14+
"ip",
15+
"url",
16+
"filehash"
17+
],
18+
"tags": [ "Enrichment" ],
19+
"support": {
20+
"tier": "Partner"
21+
},
22+
"author": {
23+
"name": "Cyble Inc."
24+
},
25+
"releaseNotes": [
26+
{
27+
"version": "1.0",
28+
"title": "Cyble-IOC_Enrichment",
29+
"notes": [ "Initial version" ]
30+
}
31+
]
32+
},
533
"triggers": {
634
"Microsoft_Sentinel_incident": {
735
"type": "ApiConnectionWebhook",
@@ -292,10 +320,17 @@
292320
},
293321
"parameters": {
294322
"$connections": {
295-
"type": "Object",
296-
"value": {
297-
"azuresentinel": {}
298-
}
299-
}
323+
"type": "Object",
324+
"value": {
325+
"azuresentinel": {
326+
"connectionId": "[resourceId('Microsoft.Web/connections', variables('apiConnectionResourceName'))]",
327+
"connectionName": "[variables('apiConnectionResourceName')]",
328+
"id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', parameters('Location'), '/managedApis/azuresentinel')]",
329+
"alternativeParameterValues": {
330+
"authenticationType": "ManagedServiceIdentity"
331+
}
332+
}
333+
}
334+
}
300335
}
301336
}

‎Solutions/Cyble Vision/Playbooks/TI-Ingest/Cyble_TI_Ingest.json‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,43 @@
11
{
22
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
33
"contentVersion": "1.0.0.0",
4+
"metadata": {
5+
"title": "Cyble-ThreatIntelligence-Ingest",
6+
"description": "This playbook imports IoC lists from Cyble and stores them as Threat Intelligence Indicators in Microsoft Sentinel, for detection purposes.\n\nThis playbook depends on Cyble-ThreatIntelligence-Ingest that need to be installed **manually** before installing this playbook.",
7+
"prerequisites": [
8+
"First install the Cyble-ThreatIntelligenceImport playbook.",
9+
"To use the Cyble for Azure connector, you will need a valid API token from Cyble"
10+
],
11+
"prerequisitesDeployTemplateFile": "../Cyble_TI_Ingest.json",
12+
"lastUpdateTime": "2025-05-06T00:00:00.000Z",
13+
"entities": [],
14+
"tags": [ "Threat Intelligence" ],
15+
"support": {
16+
"tier": "Partner",
17+
"armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator"
18+
},
19+
"author": {
20+
"name": "Cyble Inc."
21+
},
22+
"releaseNotes": [
23+
{
24+
"version": "1.0",
25+
"title": "Cyble-ThreatIntelligence-Ingest",
26+
"notes": [ "Initial version" ]
27+
}
28+
]
29+
},
430
"parameters": {
531
"PlaybookName": {
632
"defaultValue": "CybleIndicatorIngestPlaybook",
733
"type": "String"
834
},
35+
"$connections": {
36+
"type": "Object",
37+
"value": {
38+
"azuresentinel": {}
39+
}
40+
},
941
"Location": {
1042
"defaultValue": "[resourceGroup().location]",
1143
"type": "String"

‎Solutions/Cyble Vision/SolutionMetadata.json‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
{
2+
<<<<<<< Updated upstream
23
"publisherId": "TEST",
34
"offerId": "azure-sentinel",
45
"firstPublishDate": "2025-05-05",
@@ -18,5 +19,30 @@
1819
"email": "[email protected]",
1920
"tier": "Partner",
2021
"link": "https://www.cyble.com/contact"
22+
=======
23+
"$schema": "https://schema.management.azure.com/schemas/2019-08-01/solutionMetadata.json#",
24+
"contentVersion": "1.0.0.0",
25+
"solutionMetadata": {
26+
"author": "Cyble Inc",
27+
"description": "This solution provides playbooks for Cyble Vision Threat Intelligence ingestion and IOC enrichment, integrating Cyble APIs with Microsoft Sentinel.",
28+
"categories": {
29+
"domains": ["Security - Threat Protection"],
30+
"verticals": ["Security"]
31+
},
32+
"dependencies": {
33+
"contentPackages": []
34+
},
35+
"publisherId": "cybleinc1737472004964",
36+
"offerId": "cybleinc1737472004964-azure-sentinel-offerid",
37+
"firstPublishDate": "2025-04-28",
38+
"providers": ["Cyble"],
39+
"support": {
40+
"name": "Cyble Support",
41+
"email": "[email protected]",
42+
"tier": "Partner",
43+
"link": "https://www.cyble.com/contact"
44+
},
45+
"version": "1.0.0"
46+
>>>>>>> Stashed changes
2147
}
2248
}

0 commit comments

Comments
 (0)