changing how comments will look like

Author: Yaniv-Shasha

Solutions/SentinelSOARessentials/Playbooks/Incident-Trigger-Entity-Analyzer/azuredeploy.json

@@ -135,18 +135,9 @@
                                         }
                                     }
                                 },
-                                "Compose_Url": {
-                                    "runAfter": {
-                                        "URL_Analyzer": [
-                                            "Succeeded"
-                                        ]
-                                    },
-                                    "type": "Compose",
-                                    "inputs": "@concat(\r\n'🔗 **URL Analysis for: ', item()?['Url'], '**\\n\\n',\r\n'🏷️ **Classification**\\n\\n',\r\nbody('URL_Analyzer')?['classification'], '\\n\\n',\r\n'🔍 **Analysis Result**\\n\\n',\r\nbody('URL_Analyzer')?['analysis'], '\\n\\n',\r\n'✅ **Recommendation**\\n\\n',\r\nbody('URL_Analyzer')?['recommendation'], '\\n\\n',\r\n'⚠️ **Disclaimer**\\n\\n',\r\n'🤖 ', body('URL_Analyzer')?['disclaimer']\r\n)"
-                                },
                                 "Add_Url_comment_to_incident": {
                                     "runAfter": {
-                                        "Compose_Url": [
+                                        "URL_Analyzer": [
                                             "Succeeded"
                                         ]
                                     },
@@ -160,7 +151,7 @@
                                         "method": "post",
                                         "body": {
                                             "incidentArmId": "@triggerBody()?['object']?['id']",
-                                            "message": "<p class=\"editor-paragraph\">@{outputs('Compose_Url')}</p>"
+                                            "message": "<p class=\"editor-paragraph\"><b><strong class=\"editor-text-bold\">Security Analysis Report</strong></b><br><br><br><b><strong class=\"editor-text-bold\">Analysis ID:</strong></b> @{body('URL_Analyzer')?['id']}<br><br><b><strong class=\"editor-text-bold\">Entity Type:</strong></b> Url<br><br><br>🔗 <b><strong class=\"editor-text-bold\">URL Analysis for:</strong></b>@{item()}<br><br><br>🏷️ <b><strong class=\"editor-text-bold\">Classification:</strong></b> @{body('URL_Analyzer')?['classification']}<br><br><br>🔍 <b><strong class=\"editor-text-bold\">Analysis Result:</strong></b> @{body('URL_Analyzer')?['analysis']}<br><br><br>✅ <b><strong class=\"editor-text-bold\">Recommendation:</strong></b> @{body('URL_Analyzer')?['recommendation']}<br><br><br>📋 <b><strong class=\"editor-text-bold\">Data Sources:</strong></b> @{body('URL_Analyzer')?['dataSourceList']}<br><br><br>❗ <b><strong class=\"editor-text-bold\">Disclaimer:</strong></b> @{body('URL_Analyzer')?['disclaimer']}</p>"
                                         },
                                         "path": "/Incidents/Comment"
                                     }
@@ -218,18 +209,9 @@
                                         }
                                     }
                                 },
-                                "Compose_User": {
-                                    "runAfter": {
-                                        "User_Analyzer": [
-                                            "Succeeded"
-                                        ]
-                                    },
-                                    "type": "Compose",
-                                    "inputs": "@concat(\r\n'👤 **User Analysis for: ', item()?['Name'], '**\\n\\n',\r\n'🏷️ **Classification**\\n\\n',\r\nbody('User_Analyzer')?['classification'], '\\n\\n',\r\n'🔍 **Analysis Result**\\n\\n',\r\nbody('User_Analyzer')?['analysis'], '\\n\\n',\r\n'✅ **Recommendation**\\n\\n',\r\nbody('User_Analyzer')?['recommendation'], '\\n\\n',\r\n'⚠️ **Disclaimer**\\n\\n',\r\n'🤖 ', body('User_Analyzer')?['disclaimer']\r\n)"
-                                },
                                 "Add_User_comment_to_incident": {
                                     "runAfter": {
-                                        "Compose_User": [
+                                        "User_Analyzer": [
                                             "Succeeded"
                                         ]
                                     },
@@ -243,7 +225,7 @@
                                         "method": "post",
                                         "body": {
                                             "incidentArmId": "@triggerBody()?['object']?['id']",
-                                            "message": "<p class=\"editor-paragraph\">@{outputs('Compose_User')}</p>"
+                                            "message": "<p class=\"editor-paragraph\"><b><strong class=\"editor-text-bold\">Security Analysis Report</strong></b><br><br><br><b><strong class=\"editor-text-bold\">Analysis ID:</strong></b> @{body('User_Analyzer')?['id']}<br><br><b><strong class=\"editor-text-bold\">Entity Type:</strong></b> User<br><br><br>👤 <b><strong class=\"editor-text-bold\">User Analysis for:</strong></b> @{item()?['Name']}<br><br><br>🏷️ <b><strong class=\"editor-text-bold\">Classification:</strong></b> @{body('User_Analyzer')?['classification']}<br><br><br>🔍 <b><strong class=\"editor-text-bold\">Analysis Result:</strong></b> @{body('User_Analyzer')?['analysis']}<br><br><br>✅ <b><strong class=\"editor-text-bold\">Recommendation:</strong></b> @{body('User_Analyzer')?['recommendation']}<br><br><br>📋 <b><strong class=\"editor-text-bold\">Data Sources:</strong></b> @{body('User_Analyzer')?['dataSourceList']}<br><br><br>❗ <b><strong class=\"editor-text-bold\">Disclaimer:</strong></b> @{body('User_Analyzer')?['disclaimer']}</p>"
                                         },
                                         "path": "/Incidents/Comment"
                                     }

Solutions/SentinelSOARessentials/Playbooks/Url-Trigger-Entity-Analyzer/azuredeploy.json

@@ -122,18 +122,9 @@
                                 "path": "/aiprimitives/analysis"
                             }
                         },
-                        "Compose": {
-                            "runAfter": {
-                                "URL_Analyzer": [
-                                    "Succeeded"
-                                ]
-                            },
-                            "type": "Compose",
-                            "inputs": "@concat(\r\n'| 🔍 **Section** | Details |\\n',\r\n'|---|---|\\n',\r\n'| 🏷️ **Classification** | ', replace(replace(replace(coalesce(body('URL_Analyzer')?['classification'], 'N/A'), '\\r\\n', '\\n'), '\\n', '<br/>'), '|', '\\\\|'), ' |\\n',\r\n'| 🕵️ **Entity Type** | ', replace(replace(replace(coalesce(body('URL_Analyzer')?['properties']?['entityType'], 'N/A'), '\\r\\n', '\\n'), '\\n', '<br/>'), '|', '\\\\|'), ' |\\n',\r\n'| 🔎 **Analysis Result** | ', replace(replace(replace(replace(coalesce(body('URL_Analyzer')?['analysis'], 'N/A'), '- ', '• '), '\\r\\n', '\\n'), '\\n', '<br/>'), '|', '\\\\|'), ' |\\n',\r\n'| ✅ **Recommendation** | ', replace(replace(replace(coalesce(body('URL_Analyzer')?['recommendation'], 'N/A'), '\\r\\n', '\\n'), '\\n', '<br/>'), '|', '\\\\|'), ' |\\n',\r\n'| ⚠️ **Disclaimer** | 🤖 ', replace(replace(replace(coalesce(body('URL_Analyzer')?['disclaimer'], 'N/A'), '\\r\\n', '\\n'), '\\n', '<br/>'), '|', '\\\\|'), ' |\\n',\r\n'| 📂 **Data Sources** | ', if(equals(empty(body('URL_Analyzer')?['dataSourceList']), true), 'N/A', concat('• ', replace(join(body('URL_Analyzer')?['dataSourceList'], '\\n• '), '\\n', '<br/>'))), ' |'\r\n)"
-                        },
                         "Add_comment_to_incident_(V3)": {
                             "runAfter": {
-                                "Compose": [
+                                "URL_Analyzer": [
                                     "Succeeded"
                                 ]
                             },
@@ -147,7 +138,7 @@
                                 "method": "post",
                                 "body": {
                                     "incidentArmId": "@triggerBody()?['IncidentArmID']",
-                                    "message": "<p class=\"editor-paragraph\">@{outputs('Compose')}</p>"
+                                    "message": "<p class=\"editor-paragraph\"><b><strong class=\"editor-text-bold\">Security Analysis Report</strong></b><br><br><br><b><strong class=\"editor-text-bold\">Analysis ID: </strong></b>@{body('URL_Analyzer')['id']}<br><br><b><strong class=\"editor-text-bold\">Entity Type:</strong></b> Url<br><br><br>🔗 <b><strong class=\"editor-text-bold\">URL Analysis for:</strong></b> @{triggerBody()?['Entity']?['properties']?['Url']}<br><br><br>🏷️ <b><strong class=\"editor-text-bold\">Classification: </strong></b>@{body('URL_Analyzer')?['classification']}<br><br><br>🔍 <b><strong class=\"editor-text-bold\">Analysis Result: </strong></b>@{body('URL_Analyzer')?['analysis']}<br><br><br>✅<b><strong class=\"editor-text-bold\"> Recommendation:</strong></b> @{body('URL_Analyzer')?['recommendation']}<br><br><br>📋 <b><strong class=\"editor-text-bold\">Data Sources:</strong></b> @{body('URL_Analyzer')?['dataSourceList']}<br><br><br>❗ <b><strong class=\"editor-text-bold\">Disclaimer:</strong></b> @{body('URL_Analyzer')?['disclaimer']}</p>"
                                 },
                                 "path": "/Incidents/Comment"
                             }