You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/sentinel-playbook-creation.md
+8-8Lines changed: 8 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -40,8 +40,8 @@ In the Code view tab of the Azure Logic Apps editor, you can access the JSON ARM
40
40
1. Download the PowerShell script from https://aka.ms/Playbook-ARM-Template-Generator
41
41
1. Extract the folder and open "Playbook_ARM_Template_Generator.ps1" in Visual Studio Code, Windows PowerShell, or PowerShell Core.
42
42
43
-
> [!NOTE]
44
-
> Run the script from your machine. Allow PowerShell script execution by running the command in PowerShell: Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
43
+
> [!NOTE]
44
+
> Run the script from your machine. Allow PowerShell script execution by running the command in PowerShell: Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
45
45
46
46
1. Enter your Azure Tenant ID when prompted.
47
47
1. Authenticate with your credentials, then choose:
@@ -50,15 +50,15 @@ In the Code view tab of the Azure Logic Apps editor, you can access the JSON ARM
50
50
1. Select a location on your local drive to save the sanitized ARM Template as azuredeploy.json. The tool converts Microsoft Sentinel connections to Microsoft Software Installer (MSI) during export. For more information, see this demonstration video [Export your SOAR Playbooks with ease | Microsoft Sentinel in the Field #7 - YouTube](https://www.youtube.com/watch?v=scTtVHVzrQw)
51
51
1. Update the metadata section of the azuredeploy.json file with your playbook's specific details
52
52
53
-
:::image type="content" source="media/sentinel-playbook-creation/playbook-update-metadata.png" alt-text="Screenshot of playbook metadata that needs to be updated" lightbox="media/sentinel-playbook-creation/playbook-update-metadata.png" :::
53
+
:::image type="content" source="media/sentinel-playbook-creation/playbook-update-metadata.png" alt-text="Screenshot of playbook metadata that needs to be updated." lightbox="media/sentinel-playbook-creation/playbook-update-metadata.png" :::
54
54
55
55
5. It's recommended to use managed service identity rather than user-assigned identity for connecting Azure services (such as Microsoft Sentinel, Key Vault, and Storage Account) with playbooks. Update the authentication type under connectionProperties to "ManagedServiceIdentity".
56
56
57
-
:::image type="content" source="media/sentinel-playbook-creation/sentinel-playbook-identity.png" alt-text="Screenshot of playbook identity updates" lightbox="media/sentinel-playbook-creation/sentinel-playbook-identity.png" :::
57
+
:::image type="content" source="media/sentinel-playbook-creation/sentinel-playbook-identity.png" alt-text="Screenshot of playbook identity updates." lightbox="media/sentinel-playbook-creation/sentinel-playbook-identity.png" :::
58
58
59
59
6. Update "Microsoft.Web/connections" resources
60
60
61
-
:::image type="content" source="media/sentinel-playbook-creation/sentinel-playbook-webconnections.png" alt-text="Screenshot of playbook web connections metadata" lightbox="media/sentinel-playbook-creation/sentinel-playbook-webconnections.png" :::
61
+
:::image type="content" source="media/sentinel-playbook-creation/sentinel-playbook-web-connections.png" alt-text="Screenshot of playbook web connections metadata." lightbox="media/sentinel-playbook-creation/sentinel-playbook-web-connections.png" :::
62
62
63
63
For more information, see https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ThreatXCloud/Playbooks/ThreatXPlaybooks/ThreatX-BlockIP-URL/azuredeploy.json
64
64
@@ -94,7 +94,7 @@ Once the custom connector is created, you can use it to build a Playbook using A
94
94
7. Updated the JSON file created in step 4 with the swagger and backendService values obtained from the swagger file created in step 6.
95
95
1. Validate the host, basepath, and scheme parameters in the swagger file and update as needed.
9. Finally, update the Parameter section of the ARM template files for the custom connector as shown.
100
100
@@ -108,7 +108,7 @@ Refer to the link for reference or comparison to determine which other fields ne
108
108
Before making a pull request to the Microsoft Sentinel GitHub repo, follow the proper directory structure. The ARM template file must be named “azuredeploy.json.” Additionally, include a Readme.md file for all custom connectors and playbooks, detailing configuration steps during and after deployment.
109
109
110
110
For Readme.md file guidelines, refer to the links -
0 commit comments