Skip to content

Commit 1a4dcb0

Browse files
mazamizo21mazamizo21
committed
TacitRed-IOC-CrowdStrike v3.0.1: Add missing playbook discovery tags and deployment fixes
Changes from 3.0.0 to 3.0.1: - Added hidden-SentinelTemplateName and hidden-SentinelTemplateVersion tags (without these, playbook template does not appear in Automation > Playbook templates) - Fixed location parameter: removed hardcoded location, use workspace-location-inline - Removed unused TacitRed_Domain parameter and URI filter - Fixed solutionId to match Partner Center offer ID - Updated API versions from future-dated 2025-09-01 to 2023-04-01-preview - Updated publisher name to Data443 Risk Mitigation, Inc. Note: PR Azure#13641 (v3.0.1) was previously merged but only included the Solution JSON — the Package/mainTemplate.json and zip were not part of that merge. This PR adds them.
1 parent 1a159d6 commit 1a4dcb0

File tree

3 files changed

+15
-31
lines changed

3 files changed

+15
-31
lines changed

‎Solutions/TacitRed-IOC-CrowdStrike/Package/3.0.1.zip‎

5.48 KB
Binary file not shown.

‎Solutions/TacitRed-IOC-CrowdStrike/Package/mainTemplate.json‎

Lines changed: 14 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,8 @@
3333
"email": "support@data443.com",
3434
"_email": "[variables('email')]",
3535
"_solutionName": "TacitRed-IOC-CrowdStrike",
36-
"_solutionVersion": "3.0.0",
37-
"solutionId": "data443.azure-sentinel-solution-tacitred-crowdstrike-ioc-automation",
36+
"_solutionVersion": "3.0.1",
37+
"solutionId": "data443riskmitigationinc1761580347231.azure-sentinel-solution-tacitred-cs-ioc-automation",
3838
"_solutionId": "[variables('solutionId')]",
3939
"blanks": "[replace('b', 'b', '')]",
4040
"playbookVersion1": "1.0",
@@ -49,14 +49,14 @@
4949
"resources": [
5050
{
5151
"type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
52-
"apiVersion": "2025-09-01",
52+
"apiVersion": "2023-04-01-preview",
5353
"name": "[variables('playbookTemplateSpecName1')]",
5454
"location": "[parameters('workspace-location')]",
5555
"dependsOn": [
5656
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
5757
],
5858
"properties": {
59-
"description": "pb-tacitred-to-crowdstrike Playbook with template version 3.0.0",
59+
"description": "pb-tacitred-to-crowdstrike Playbook with template version 3.0.1",
6060
"mainTemplate": {
6161
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
6262
"contentVersion": "[variables('playbookVersion1')]",
@@ -65,24 +65,13 @@
6565
"type": "string",
6666
"defaultValue": "pb-tacitred-to-crowdstrike"
6767
},
68-
"location": {
69-
"type": "string",
70-
"defaultValue": "[concat('[resourceGroup().locatio', 'n]')]"
71-
},
7268
"TacitRed_ApiKey": {
7369
"type": "securestring",
7470
"defaultValue": "",
7571
"metadata": {
7672
"description": "TacitRed API Key for authentication"
7773
}
7874
},
79-
"TacitRed_Domain": {
80-
"type": "string",
81-
"defaultValue": "",
82-
"metadata": {
83-
"description": "Optional domain filter for TacitRed findings"
84-
}
85-
},
8675
"CrowdStrike_ClientId": {
8776
"type": "securestring",
8877
"defaultValue": "",
@@ -108,16 +97,13 @@
10897
"type": "Microsoft.Logic/workflows",
10998
"apiVersion": "2019-05-01",
11099
"name": "[[parameters('PlaybookName')]",
111-
"location": "[[parameters('location')]",
100+
"location": "[[variables('workspace-location-inline')]",
112101
"properties": {
113102
"state": "Enabled",
114103
"parameters": {
115104
"TacitRed_ApiKey": {
116105
"value": "[[parameters('TacitRed_ApiKey')]"
117106
},
118-
"TacitRed_Domain": {
119-
"value": "[[parameters('TacitRed_Domain')]"
120-
},
121107
"CrowdStrike_ClientId": {
122108
"value": "[[parameters('CrowdStrike_ClientId')]"
123109
},
@@ -137,10 +123,6 @@
137123
"type": "string",
138124
"defaultValue": "[variables('blanks')]"
139125
},
140-
"TacitRed_Domain": {
141-
"type": "string",
142-
"defaultValue": "[variables('blanks')]"
143-
},
144126
"CrowdStrike_BaseUrl": {
145127
"type": "string",
146128
"defaultValue": "https://api.us-2.crowdstrike.com"
@@ -177,7 +159,7 @@
177159
"type": "Http",
178160
"inputs": {
179161
"method": "GET",
180-
"uri": "@{parameters('TacitRed_ApiUrl')}?types[]=compromised_credentials&domains[]=@{encodeUriComponent(if(empty(parameters('TacitRed_Domain')),'',parameters('TacitRed_Domain')))}&page=1&page_size=50",
162+
"uri": "@{parameters('TacitRed_ApiUrl')}?types[]=compromised_credentials&page=1&page_size=50",
181163
"headers": {
182164
"accept": "application/json",
183165
"Authorization": "@{parameters('TacitRed_ApiKey')}"
@@ -249,12 +231,14 @@
249231
}
250232
},
251233
"tags": {
234+
"hidden-SentinelTemplateName": "TacitRedToCrowdStrike",
235+
"hidden-SentinelTemplateVersion": "1.0",
252236
"hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]"
253237
}
254238
},
255239
{
256240
"type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
257-
"apiVersion": "2025-09-01",
241+
"apiVersion": "2022-01-01-preview",
258242
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId1'),'/'))))]",
259243
"properties": {
260244
"parentId": "[variables('playbookId1')]",
@@ -267,7 +251,7 @@
267251
"sourceId": "[variables('_solutionId')]"
268252
},
269253
"author": {
270-
"name": "TacitRed",
254+
"name": "Data443 Risk Mitigation, Inc.",
271255
"email": "[variables('_email')]"
272256
},
273257
"support": {
@@ -288,8 +272,7 @@
288272
"postDeployment": [
289273
"1. Configure the TacitRed API Key parameter",
290274
"2. Configure the CrowdStrike Client ID and Client Secret parameters",
291-
"3. Optionally set a domain filter to limit findings to specific domains",
292-
"4. Enable the Logic App and configure the recurrence trigger as needed"
275+
"3. Enable the Logic App and configure the recurrence trigger as needed"
293276
],
294277
"lastUpdateTime": "2026-01-22T00:00:00Z",
295278
"tags": [
@@ -322,10 +305,10 @@
322305
},
323306
{
324307
"type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages",
325-
"apiVersion": "2025-09-01",
308+
"apiVersion": "2023-04-01-preview",
326309
"location": "[parameters('workspace-location')]",
327310
"properties": {
328-
"version": "3.0.0",
311+
"version": "3.0.1",
329312
"kind": "Solution",
330313
"contentSchemaVersion": "3.0.0",
331314
"displayName": "TacitRed-IOC-CrowdStrike",
@@ -343,7 +326,7 @@
343326
"sourceId": "[variables('_solutionId')]"
344327
},
345328
"author": {
346-
"name": "TacitRed",
329+
"name": "Data443 Risk Mitigation, Inc.",
347330
"email": "[variables('_email')]"
348331
},
349332
"support": {

‎Solutions/TacitRed-IOC-CrowdStrike/ReleaseNotes.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
22
|-------------|--------------------------------|--------------------|
3+
| 3.0.1 | 26-02-2026 | Added missing hidden-SentinelTemplateName and hidden-SentinelTemplateVersion tags for playbook template discovery in Content Hub. Fixed location parameter to use workspace-location-inline. Removed unused TacitRed_Domain parameter. Fixed solutionId to match Partner Center offer. Updated API versions and publisher name. |
34
| 3.0.0 | 23-01-2026 | Initial Solution Release - **Playbook** for automated IOC synchronization between TacitRed and CrowdStrike Falcon. Supports Domain and SHA256 IOC types. |

0 commit comments

Comments
 (0)