Skip to content

Commit ae8f23e

Browse files
v-maheshbhv-maheshbh
committed
Add metadata to Sentinel SOAR playbooks and templates
Introduced detailed metadata sections to mainTemplate.json and playbook deployment templates for HTTP, Incident, and URL Entity Analyzer playbooks. Metadata includes title, description, prerequisites, post-deployment steps, supported entities, tags, release notes, support tier, and author information to improve documentation and deployment clarity.
1 parent 8abf54c commit ae8f23e

File tree

5 files changed

+207
-3
lines changed

5 files changed

+207
-3
lines changed

‎Solutions/SentinelSOARessentials/Package/3.0.4.zip‎

923 Bytes
Binary file not shown.

‎Solutions/SentinelSOARessentials/Package/mainTemplate.json‎

Lines changed: 105 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7628,7 +7628,43 @@
76287628
}
76297629
}
76307630
}
7631-
]
7631+
],
7632+
"metadata": {
7633+
"title": "HTTP Trigger Entity Analyzer",
7634+
"description": "This playbook is triggered by HTTP POST requests with entity information and performs automated investigation and enrichment of URL and User entities with asynchronous processing.",
7635+
"prerequisites": [
7636+
"1. The user deploying this Logic App needs to have a Contributor Role.",
7637+
"2. The user has permissions to access Microsoft Sentinel workspace.",
7638+
"3. Microsoft Sentinel data connector lake must be enabled in your workspace for entity data collection.",
7639+
"4. The SentinelMCP connector is available in your environment.",
7640+
"5. You need to provide a valid Sentinel workspace ID during deployment.",
7641+
"6. Authentication support for the Entity Analyzer connection includes Entra ID Authentication (OAuth), Service Principal (Application ID and Secret), or Managed Identity (System-assigned or User-assigned)."
7642+
],
7643+
"postDeployment": [
7644+
"1. Authenticate the connections: Go to the Logic App → API connections and authenticate SentinelMCP connection with Microsoft Sentinel MCP permissions.",
7645+
"2. Authenticate the Entity Analyzer connection using one of the supported methods: Entra ID Auth, Service Principal, or Managed Identity.",
7646+
"3. Get the HTTP endpoint URL: Open the Logic App → Go to Logic app designer → Click on the HTTP trigger → Copy the HTTP POST URL.",
7647+
"4. The playbook will trigger when POST requests are sent to the HTTP endpoint."
7648+
],
7649+
"lastUpdateTime": "2025-12-07T00:00:00Z",
7650+
"entities": [
7651+
"URL",
7652+
"Account"
7653+
],
7654+
"tags": [
7655+
"Enrichment",
7656+
"Utilities",
7657+
"Entity Analysis",
7658+
"API Integration"
7659+
],
7660+
"releaseNotes": {
7661+
"version": "1.0",
7662+
"title": "[variables('blanks')]",
7663+
"notes": [
7664+
"Initial version"
7665+
]
7666+
}
7667+
}
76327668
},
76337669
"packageKind": "Solution",
76347670
"packageVersion": "[variables('_solutionVersion')]",
@@ -7956,7 +7992,40 @@
79567992
}
79577993
}
79587994
}
7959-
]
7995+
],
7996+
"metadata": {
7997+
"title": "Incident Trigger Entity Analyzer",
7998+
"description": "This playbook is triggered by Microsoft Sentinel incidents and performs automated investigation and enrichment of URL and User entities associated with the incident.",
7999+
"prerequisites": [
8000+
"1. A Microsoft Sentinel workspace must be configured.",
8001+
"2. The user deploying this Logic App needs to have a Contributor Role.",
8002+
"3. The user has permissions to access Microsoft Sentinel workspace.",
8003+
"4. The SentinelMCP connector is available in your environment."
8004+
],
8005+
"postDeployment": [
8006+
"1. Authenticate the connections: Go to the Logic App → API connections and authenticate Microsoft Sentinel connection with a user that has Sentinel permissions.",
8007+
"2. Authenticate the SentinelMCP connection with Microsoft Sentinel MCP permissions.",
8008+
"3. The playbook will automatically trigger when new incidents are created.",
8009+
"4. Consider creating an automation rule to run this playbook automatically on specific incident types."
8010+
],
8011+
"lastUpdateTime": "2025-12-07T00:00:00Z",
8012+
"entities": [
8013+
"URL",
8014+
"Account"
8015+
],
8016+
"tags": [
8017+
"Enrichment",
8018+
"Utilities",
8019+
"Entity Analysis"
8020+
],
8021+
"releaseNotes": {
8022+
"version": "1.0",
8023+
"title": "[variables('blanks')]",
8024+
"notes": [
8025+
"Initial version"
8026+
]
8027+
}
8028+
}
79608029
},
79618030
"packageKind": "Solution",
79628031
"packageVersion": "[variables('_solutionVersion')]",
@@ -8186,7 +8255,40 @@
81868255
}
81878256
}
81888257
}
8189-
]
8258+
],
8259+
"metadata": {
8260+
"title": "URL Entity Trigger Analyzer",
8261+
"description": "This playbook is triggered manually when a URL entity is selected in a Microsoft Sentinel incident and provides detailed security insights including classification, analysis results, and recommendations.",
8262+
"prerequisites": [
8263+
"1. The user deploying this Logic App needs to have a Contributor Role.",
8264+
"2. The user has permissions to access Microsoft Sentinel workspace.",
8265+
"3. You have the Workspace ID for your Sentinel environment.",
8266+
"4. The SentinelMCP connector is available in your environment.",
8267+
"5. Access to Microsoft Sentinel portal in Azure (not Defender portal)."
8268+
],
8269+
"postDeployment": [
8270+
"1. Authenticate the connections: Go to the Logic App → API connections and authenticate Microsoft Sentinel connection with a user that has Sentinel permissions.",
8271+
"2. Authenticate the SentinelMCP connection with Microsoft Sentinel MCP permissions.",
8272+
"3. The playbook will be available to run manually from incident entities.",
8273+
"4. Results will be automatically added as comments to the relevant incidents."
8274+
],
8275+
"lastUpdateTime": "2025-12-07T00:00:00Z",
8276+
"entities": [
8277+
"URL"
8278+
],
8279+
"tags": [
8280+
"Enrichment",
8281+
"Utilities",
8282+
"Entity Analysis"
8283+
],
8284+
"releaseNotes": {
8285+
"version": "1.0",
8286+
"title": "[variables('blanks')]",
8287+
"notes": [
8288+
"Initial version"
8289+
]
8290+
}
8291+
}
81908292
},
81918293
"packageKind": "Solution",
81928294
"packageVersion": "[variables('_solutionVersion')]",

‎Solutions/SentinelSOARessentials/Playbooks/Http-Trigger-Entity-Analyzer/azuredeploy.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,42 @@
11
{
22
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
33
"contentVersion": "1.0.0.0",
4+
"metadata": {
5+
"title": "HTTP Trigger Entity Analyzer",
6+
"description": "This playbook is triggered by HTTP POST requests with entity information and performs automated investigation and enrichment of URL and User entities with asynchronous processing.",
7+
"prerequisites": [
8+
"1. The user deploying this Logic App needs to have a Contributor Role.",
9+
"2. The user has permissions to access Microsoft Sentinel workspace.",
10+
"3. Microsoft Sentinel data connector lake must be enabled in your workspace for entity data collection.",
11+
"4. The SentinelMCP connector is available in your environment.",
12+
"5. You need to provide a valid Sentinel workspace ID during deployment.",
13+
"6. Authentication support for the Entity Analyzer connection includes Entra ID Authentication (OAuth), Service Principal (Application ID and Secret), or Managed Identity (System-assigned or User-assigned)."
14+
],
15+
"postDeployment": [
16+
"1. Authenticate the connections: Go to the Logic App → API connections and authenticate SentinelMCP connection with Microsoft Sentinel MCP permissions.",
17+
"2. Authenticate the Entity Analyzer connection using one of the supported methods: Entra ID Auth, Service Principal, or Managed Identity.",
18+
"3. Get the HTTP endpoint URL: Open the Logic App → Go to Logic app designer → Click on the HTTP trigger → Copy the HTTP POST URL.",
19+
"4. The playbook will trigger when POST requests are sent to the HTTP endpoint."
20+
],
21+
"prerequisitesDeployTemplateFile": "",
22+
"lastUpdateTime": "2025-12-07T00:00:00.000Z",
23+
"entities": [
24+
"URL",
25+
"Account"
26+
],
27+
"tags": [
28+
"Enrichment",
29+
"Utilities",
30+
"Entity Analysis",
31+
"API Integration"
32+
],
33+
"support": {
34+
"tier": "community"
35+
},
36+
"author": {
37+
"name": "yaniv shasha"
38+
}
39+
},
440
"parameters": {
541
"PlaybookName": {
642
"defaultValue": "Http-Trigger-Entity-Analyzer",

‎Solutions/SentinelSOARessentials/Playbooks/Incident-Trigger-Entity-Analyzer/azuredeploy.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,39 @@
11
{
22
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
33
"contentVersion": "1.0.0.0",
4+
"metadata": {
5+
"title": "Incident Trigger Entity Analyzer",
6+
"description": "This playbook is triggered by Microsoft Sentinel incidents and performs automated investigation and enrichment of URL and User entities associated with the incident.",
7+
"prerequisites": [
8+
"1. A Microsoft Sentinel workspace must be configured.",
9+
"2. The user deploying this Logic App needs to have a Contributor Role.",
10+
"3. The user has permissions to access Microsoft Sentinel workspace.",
11+
"4. The SentinelMCP connector is available in your environment."
12+
],
13+
"postDeployment": [
14+
"1. Authenticate the connections: Go to the Logic App → API connections and authenticate Microsoft Sentinel connection with a user that has Sentinel permissions.",
15+
"2. Authenticate the SentinelMCP connection with Microsoft Sentinel MCP permissions.",
16+
"3. The playbook will automatically trigger when new incidents are created.",
17+
"4. Consider creating an automation rule to run this playbook automatically on specific incident types."
18+
],
19+
"prerequisitesDeployTemplateFile": "",
20+
"lastUpdateTime": "2025-12-07T00:00:00.000Z",
21+
"entities": [
22+
"URL",
23+
"Account"
24+
],
25+
"tags": [
26+
"Enrichment",
27+
"Utilities",
28+
"Entity Analysis"
29+
],
30+
"support": {
31+
"tier": "community"
32+
},
33+
"author": {
34+
"name": "yaniv shasha"
35+
}
36+
},
437
"parameters": {
538
"PlaybookName": {
639
"defaultValue": "Entity-Analyzer-Incident-Trigger",

‎Solutions/SentinelSOARessentials/Playbooks/Url-Trigger-Entity-Analyzer/azuredeploy.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,39 @@
11
{
22
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
33
"contentVersion": "1.0.0.0",
4+
"metadata": {
5+
"title": "URL Entity Trigger Analyzer",
6+
"description": "This playbook is triggered manually when a URL entity is selected in a Microsoft Sentinel incident and provides detailed security insights including classification, analysis results, and recommendations.",
7+
"prerequisites": [
8+
"1. The user deploying this Logic App needs to have a Contributor Role.",
9+
"2. The user has permissions to access Microsoft Sentinel workspace.",
10+
"3. You have the Workspace ID for your Sentinel environment.",
11+
"4. The SentinelMCP connector is available in your environment.",
12+
"5. Access to Microsoft Sentinel portal in Azure (not Defender portal)."
13+
],
14+
"postDeployment": [
15+
"1. Authenticate the connections: Go to the Logic App → API connections and authenticate Microsoft Sentinel connection with a user that has Sentinel permissions.",
16+
"2. Authenticate the SentinelMCP connection with Microsoft Sentinel MCP permissions.",
17+
"3. The playbook will be available to run manually from incident entities.",
18+
"4. Results will be automatically added as comments to the relevant incidents."
19+
],
20+
"prerequisitesDeployTemplateFile": "",
21+
"lastUpdateTime": "2025-12-07T00:00:00.000Z",
22+
"entities": [
23+
"URL"
24+
],
25+
"tags": [
26+
"Enrichment",
27+
"Utilities",
28+
"Entity Analysis"
29+
],
30+
"support": {
31+
"tier": "community"
32+
},
33+
"author": {
34+
"name": "yaniv shasha"
35+
}
36+
},
437
"parameters": {
538
"PlaybookName": {
639
"defaultValue": "Entity-analyzer-Url-Trigger",

0 commit comments

Comments
 (0)