You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/sentinel-playbook-creation.md
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -58,9 +58,9 @@ In the Code view tab of the Azure Logic Apps editor, you can access the JSON ARM
58
58
59
59
6. Update "Microsoft.Web/connections" resources
60
60
61
-
:::image type="content" source="media/sentinel-playbook-creation/sentinel-playbook-webconnections.png" alt-text="Screenshot of playbook metadata that needs to be updated" lightbox="media/sentinel-playbook-creation/sentinel-playbook-webconnections.png" :::
61
+
:::image type="content" source="media/sentinel-playbook-creation/sentinel-playbook-webconnections.png" alt-text="Screenshot of playbook web connections metadata" lightbox="media/sentinel-playbook-creation/sentinel-playbook-webconnections.png" :::
62
62
63
-
Refer to this file for more detailshttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ThreatXCloud/Playbooks/ThreatXPlaybooks/ThreatX-BlockIP-URL/azuredeploy.json
63
+
For more information, seehttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ThreatXCloud/Playbooks/ThreatXPlaybooks/ThreatX-BlockIP-URL/azuredeploy.json
64
64
65
65
### Scenario 2: Playbook using custom connectors
66
66
@@ -82,23 +82,23 @@ Once the custom connector is created, you can use it to build a Playbook using A
82
82
1. Search for **Logic Apps Custom Connector**
83
83
1. Open the connector and then select on Export template under Automation link.
84
84
85
-
:::image type="content" source="media/sentinel-playbook-creation/sentinel-playbook-export-template.png" alt-text="Screenshot of offer ID and offer name configuration." Lightbox="media/sentinel-playbook-creation/sentinel-playbook-export-template.png" :::
85
+
:::image type="content" source="media/sentinel-playbook-creation/sentinel-playbook-export-template.png" alt-text="Screenshot to export template." Lightbox="media/sentinel-playbook-creation/sentinel-playbook-export-template.png" :::
86
86
87
87
4. Select "Copy template" and save contents in a JSON file on your local computer
88
88
1. From the JSON created in step 4, remove the runtimeUrls, apiDefinitions, and wsdlDefinition fields
89
89
1. Download the file containing swagger attributes. Select on the Overview link and then on the Download link. This downloads the swagger file
90
90
91
-
:::image type="content" source="media/sentinel-playbook-creation/sentinel-playbook-download-swagger.png" alt-text="Screenshot of offer ID and offer name configuration." Lightbox="media/sentinel-playbook-creation/sentinel-playbook-download-swagger.png" :::
91
+
:::image type="content" source="media/sentinel-playbook-creation/sentinel-playbook-download-swagger.png" alt-text="Screenshot to download swagger file." Lightbox="media/sentinel-playbook-creation/sentinel-playbook-download-swagger.png" :::
92
92
93
93
94
94
7. Updated the JSON file created in step 4 with the swagger and backendService values obtained from the swagger file created in step 6.
95
95
1. Validate the host, basepath, and scheme parameters in the swagger file and update as needed.
96
96
97
-
:::image type="content" source="media/sentinel-playbook-creation/sentinel-playbookswagger-fields.png" alt-text="Screenshot of offer ID and offer name configuration." Lightbox="media/sentinel-playbook-creation/sentinel-playbookswagger-fields.png" :::
9. Finally, update the Parameter section of the ARM template files for the custom connector as shown.
100
100
101
-
:::image type="content" source="media/sentinel-playbook-creation/playbook-update-parameters.png" alt-text="Screenshot of offer ID and offer name configuration." Lightbox="media/sentinel-playbook-creation/playbook-update-parameters.png" :::
Refer to the link for reference or comparison to determine which other fields need to be modified within the ARM template.
104
104
[Azure-Sentinel/Solutions/Minemeld/Playbooks/CustomConnector/MinemeldCustomConnector/azuredeploy.json at master · Azure/Azure-Sentinel](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Minemeld/Playbooks/CustomConnector/MinemeldCustomConnector/azuredeploy.json)
@@ -111,4 +111,4 @@ For Readme.md file guidelines, refer to the links -
:::image type="content" source="media/sentinel-playbook-creation/playbook-folder-structure.png" alt-text="Screenshot of offer ID and offer name configuration." Lightbox="media/sentinel-playbook-creation/playbook-folder-structure.png" :::
114
+
:::image type="content" source="media/sentinel-playbook-creation/playbook-folder-structure.png" alt-text="Screenshot of playbook folder structure in GitHub." Lightbox="media/sentinel-playbook-creation/playbook-folder-structure.png" :::
0 commit comments