Skip to content

Commit 444c1a4

Browse files
author
Anil Godavarthy
committed
Fixed feedback.
1 parent 55522d1 commit 444c1a4

File tree

3 files changed

+8
-8
lines changed

3 files changed

+8
-8
lines changed

articles/sentinel/sentinel-playbook-creation.md

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,8 @@ In the Code view tab of the Azure Logic Apps editor, you can access the JSON ARM
4040
1. Download the PowerShell script from https://aka.ms/Playbook-ARM-Template-Generator
4141
1. Extract the folder and open "Playbook_ARM_Template_Generator.ps1" in Visual Studio Code, Windows PowerShell, or PowerShell Core.
4242

43-
> [!NOTE]
44-
> Run the script from your machine. Allow PowerShell script execution by running the command in PowerShell: Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
43+
> [!NOTE]
44+
> Run the script from your machine. Allow PowerShell script execution by running the command in PowerShell: Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
4545
4646
1. Enter your Azure Tenant ID when prompted.
4747
1. Authenticate with your credentials, then choose:
@@ -50,15 +50,15 @@ In the Code view tab of the Azure Logic Apps editor, you can access the JSON ARM
5050
1. Select a location on your local drive to save the sanitized ARM Template as azuredeploy.json. The tool converts Microsoft Sentinel connections to Microsoft Software Installer (MSI) during export. For more information, see this demonstration video [Export your SOAR Playbooks with ease | Microsoft Sentinel in the Field #7 - YouTube](https://www.youtube.com/watch?v=scTtVHVzrQw)
5151
1. Update the metadata section of the azuredeploy.json file with your playbook's specific details
5252

53-
:::image type="content" source="media/sentinel-playbook-creation/playbook-update-metadata.png" alt-text="Screenshot of playbook metadata that needs to be updated" lightbox="media/sentinel-playbook-creation/playbook-update-metadata.png" :::
53+
:::image type="content" source="media/sentinel-playbook-creation/playbook-update-metadata.png" alt-text="Screenshot of playbook metadata that needs to be updated." lightbox="media/sentinel-playbook-creation/playbook-update-metadata.png" :::
5454

5555
5. It's recommended to use managed service identity rather than user-assigned identity for connecting Azure services (such as Microsoft Sentinel, Key Vault, and Storage Account) with playbooks. Update the authentication type under connectionProperties to "ManagedServiceIdentity".
5656

57-
:::image type="content" source="media/sentinel-playbook-creation/sentinel-playbook-identity.png" alt-text="Screenshot of playbook identity updates" lightbox="media/sentinel-playbook-creation/sentinel-playbook-identity.png" :::
57+
:::image type="content" source="media/sentinel-playbook-creation/sentinel-playbook-identity.png" alt-text="Screenshot of playbook identity updates." lightbox="media/sentinel-playbook-creation/sentinel-playbook-identity.png" :::
5858

5959
6. Update "Microsoft.Web/connections" resources
6060

61-
:::image type="content" source="media/sentinel-playbook-creation/sentinel-playbook-webconnections.png" alt-text="Screenshot of playbook web connections metadata" lightbox="media/sentinel-playbook-creation/sentinel-playbook-webconnections.png" :::
61+
:::image type="content" source="media/sentinel-playbook-creation/sentinel-playbook-web-connections.png" alt-text="Screenshot of playbook web connections metadata." lightbox="media/sentinel-playbook-creation/sentinel-playbook-web-connections.png" :::
6262

6363
For more information, see https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ThreatXCloud/Playbooks/ThreatXPlaybooks/ThreatX-BlockIP-URL/azuredeploy.json
6464

@@ -94,7 +94,7 @@ Once the custom connector is created, you can use it to build a Playbook using A
9494
7. Updated the JSON file created in step 4 with the swagger and backendService values obtained from the swagger file created in step 6.
9595
1. Validate the host, basepath, and scheme parameters in the swagger file and update as needed.
9696

97-
:::image type="content" source="media/sentinel-playbook-creation/sentinel-playbookswagger-fields.png" alt-text="Screenshot showing swagger fields." Lightbox="media/sentinel-playbook-creation/sentinel-playbookswagger-fields.png" :::
97+
:::image type="content" source="media/sentinel-playbook-creation/sentinel-playbook-swagger-fields.png" alt-text="Screenshot showing swagger fields." Lightbox="media/sentinel-playbook-creation/sentinel-playbook-swagger-fields.png" :::
9898

9999
9. Finally, update the Parameter section of the ARM template files for the custom connector as shown.
100100

@@ -108,7 +108,7 @@ Refer to the link for reference or comparison to determine which other fields ne
108108
Before making a pull request to the Microsoft Sentinel GitHub repo, follow the proper directory structure. The ARM template file must be named “azuredeploy.json.” Additionally, include a Readme.md file for all custom connectors and playbooks, detailing configuration steps during and after deployment.
109109

110110
For Readme.md file guidelines, refer to the links -
111-
- Custom connector Readme.md file guidelines: [Custom connector Readme.md file guidelines | Microsoft Learn](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Minemeld/Playbooks/CustomConnector/MinemeldCustomConnector)
112-
- Playbook Readme.md file guidelines: [Playbook Readme.md file guidelines | Microsoft Learn](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Minemeld/Playbooks/MinemeldPlaybooks/Minemeld-CreateIndicator)
111+
- [Custom connector Readme.md file guidelines](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Minemeld/Playbooks/CustomConnector/MinemeldCustomConnector)
112+
- [Playbook Readme.md file guidelines](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Minemeld/Playbooks/MinemeldPlaybooks/Minemeld-CreateIndicator)
113113

114114
:::image type="content" source="media/sentinel-playbook-creation/playbook-folder-structure.png" alt-text="Screenshot of playbook folder structure in GitHub." Lightbox="media/sentinel-playbook-creation/playbook-folder-structure.png" :::

0 commit comments

Comments
 (0)