Skip to content

Commit ddf0aae

Browse files
v-atulyadavv-atulyadav
authored
Merge pull request Azure#13295 from Yaniv-Shasha/master
Entity-analyzer-Fixes
2 parents 5e724ba + e09325c commit ddf0aae

File tree

6 files changed

+72
-105
lines changed

6 files changed

+72
-105
lines changed

‎Solutions/SentinelSOARessentials/Package/3.0.5.zip‎

73.2 KB
Binary file not shown.

‎Solutions/SentinelSOARessentials/Package/mainTemplate.json‎

Lines changed: 49 additions & 66 deletions
Large diffs are not rendered by default.

‎Solutions/SentinelSOARessentials/Playbooks/Http-Trigger-Entity-Analyzer/azuredeploy.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@
5252
}
5353
},
5454
"lookBackDays": {
55-
"defaultValue": 40,
55+
"defaultValue": 7,
5656
"type": "int",
5757
"metadata": {
5858
"description": "Number of days to look back for entity analysis"

‎Solutions/SentinelSOARessentials/Playbooks/Incident-Trigger-Entity-Analyzer/azuredeploy.json‎

Lines changed: 17 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@
4040
"type": "string"
4141
},
4242
"lookBackDays": {
43-
"defaultValue": 60,
43+
"defaultValue": 7,
4444
"type": "int",
4545
"metadata": {
4646
"description": "Number of days to look back for entity analysis"
@@ -135,18 +135,9 @@
135135
}
136136
}
137137
},
138-
"Compose_Url": {
139-
"runAfter": {
140-
"URL_Analyzer": [
141-
"Succeeded"
142-
]
143-
},
144-
"type": "Compose",
145-
"inputs": "@concat(\r\n'🔗 **URL Analysis for: ', item()?['Url'], '**\\n\\n',\r\n'🏷️ **Classification**\\n\\n',\r\nbody('URL_Analyzer')?['classification'], '\\n\\n',\r\n'🔍 **Analysis Result**\\n\\n',\r\nbody('URL_Analyzer')?['analysis'], '\\n\\n',\r\n'✅ **Recommendation**\\n\\n',\r\nbody('URL_Analyzer')?['recommendation'], '\\n\\n',\r\n'⚠️ **Disclaimer**\\n\\n',\r\n'🤖 ', body('URL_Analyzer')?['disclaimer']\r\n)"
146-
},
147138
"Add_Url_comment_to_incident": {
148139
"runAfter": {
149-
"Compose_Url": [
140+
"URL_Analyzer": [
150141
"Succeeded"
151142
]
152143
},
@@ -160,7 +151,7 @@
160151
"method": "post",
161152
"body": {
162153
"incidentArmId": "@triggerBody()?['object']?['id']",
163-
"message": "<p class=\"editor-paragraph\">@{outputs('Compose_Url')}</p>"
154+
"message": "<p class=\"editor-paragraph\"><b><strong class=\"editor-text-bold\">Security Analysis Report</strong></b><br><br><br><b><strong class=\"editor-text-bold\">Analysis ID:</strong></b> @{body('URL_Analyzer')?['id']}<br><br><b><strong class=\"editor-text-bold\">Entity Type:</strong></b> Url<br><br><br>🔗 <b><strong class=\"editor-text-bold\">URL Analysis for:</strong></b>@{item()}<br><br><br>🏷️ <b><strong class=\"editor-text-bold\">Classification:</strong></b> @{body('URL_Analyzer')?['classification']}<br><br><br>🔍 <b><strong class=\"editor-text-bold\">Analysis Result:</strong></b> @{body('URL_Analyzer')?['analysis']}<br><br><br>✅ <b><strong class=\"editor-text-bold\">Recommendation:</strong></b> @{body('URL_Analyzer')?['recommendation']}<br><br><br>📋 <b><strong class=\"editor-text-bold\">Data Sources:</strong></b> @{body('URL_Analyzer')?['dataSourceList']}<br><br><br>❗ <b><strong class=\"editor-text-bold\">Disclaimer:</strong></b> @{body('URL_Analyzer')?['disclaimer']}</p>"
164155
},
165156
"path": "/Incidents/Comment"
166157
}
@@ -171,7 +162,12 @@
171162
"Succeeded"
172163
]
173164
},
174-
"type": "Foreach"
165+
"type": "Foreach",
166+
"runtimeConfiguration": {
167+
"concurrency": {
168+
"repetitions": 5
169+
}
170+
}
175171
},
176172
"Entities_-_Get_Accounts": {
177173
"runAfter": {},
@@ -213,18 +209,9 @@
213209
}
214210
}
215211
},
216-
"Compose_User": {
217-
"runAfter": {
218-
"User_Analyzer": [
219-
"Succeeded"
220-
]
221-
},
222-
"type": "Compose",
223-
"inputs": "@concat(\r\n'👤 **User Analysis for: ', item()?['Name'], '**\\n\\n',\r\n'🏷️ **Classification**\\n\\n',\r\nbody('User_Analyzer')?['classification'], '\\n\\n',\r\n'🔍 **Analysis Result**\\n\\n',\r\nbody('User_Analyzer')?['analysis'], '\\n\\n',\r\n'✅ **Recommendation**\\n\\n',\r\nbody('User_Analyzer')?['recommendation'], '\\n\\n',\r\n'⚠️ **Disclaimer**\\n\\n',\r\n'🤖 ', body('User_Analyzer')?['disclaimer']\r\n)"
224-
},
225212
"Add_User_comment_to_incident": {
226213
"runAfter": {
227-
"Compose_User": [
214+
"User_Analyzer": [
228215
"Succeeded"
229216
]
230217
},
@@ -238,7 +225,7 @@
238225
"method": "post",
239226
"body": {
240227
"incidentArmId": "@triggerBody()?['object']?['id']",
241-
"message": "<p class=\"editor-paragraph\">@{outputs('Compose_User')}</p>"
228+
"message": "<p class=\"editor-paragraph\"><b><strong class=\"editor-text-bold\">Security Analysis Report</strong></b><br><br><br><b><strong class=\"editor-text-bold\">Analysis ID:</strong></b> @{body('User_Analyzer')?['id']}<br><br><b><strong class=\"editor-text-bold\">Entity Type:</strong></b> User<br><br><br>👤 <b><strong class=\"editor-text-bold\">User Analysis for:</strong></b> @{item()?['Name']}<br><br><br>🏷️ <b><strong class=\"editor-text-bold\">Classification:</strong></b> @{body('User_Analyzer')?['classification']}<br><br><br>🔍 <b><strong class=\"editor-text-bold\">Analysis Result:</strong></b> @{body('User_Analyzer')?['analysis']}<br><br><br>✅ <b><strong class=\"editor-text-bold\">Recommendation:</strong></b> @{body('User_Analyzer')?['recommendation']}<br><br><br>📋 <b><strong class=\"editor-text-bold\">Data Sources:</strong></b> @{body('User_Analyzer')?['dataSourceList']}<br><br><br>❗ <b><strong class=\"editor-text-bold\">Disclaimer:</strong></b> @{body('User_Analyzer')?['disclaimer']}</p>"
242229
},
243230
"path": "/Incidents/Comment"
244231
}
@@ -249,7 +236,12 @@
249236
"Succeeded"
250237
]
251238
},
252-
"type": "Foreach"
239+
"type": "Foreach",
240+
"runtimeConfiguration": {
241+
"concurrency": {
242+
"repetitions": 5
243+
}
244+
}
253245
}
254246
},
255247
"outputs": {}

‎Solutions/SentinelSOARessentials/Playbooks/Url-Trigger-Entity-Analyzer/azuredeploy.json‎

Lines changed: 4 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
33
"contentVersion": "1.0.0.0",
44
"metadata": {
5-
"title": "URL Entity Trigger Analyzer",
5+
"title": "URL Trigger Entity Analyzer",
66
"description": "This playbook is triggered manually when a URL entity is selected in a Microsoft Sentinel incident and provides detailed security insights including classification, analysis results, and recommendations.",
77
"prerequisites": [
88
"1. The user deploying this Logic App needs to have a Contributor Role.",
@@ -40,7 +40,7 @@
4040
"type": "string"
4141
},
4242
"lookBackDays": {
43-
"defaultValue": 10,
43+
"defaultValue": 7,
4444
"type": "int",
4545
"metadata": {
4646
"description": "Number of days to look back for entity analysis"
@@ -122,18 +122,9 @@
122122
"path": "/aiprimitives/analysis"
123123
}
124124
},
125-
"Compose": {
126-
"runAfter": {
127-
"URL_Analyzer": [
128-
"Succeeded"
129-
]
130-
},
131-
"type": "Compose",
132-
"inputs": "@concat(\r\n'| 🔍 **Section** | Details |\\n',\r\n'|---|---|\\n',\r\n'| 🏷️ **Classification** | ', replace(replace(replace(coalesce(body('URL_Analyzer')?['classification'], 'N/A'), '\\r\\n', '\\n'), '\\n', '<br/>'), '|', '\\\\|'), ' |\\n',\r\n'| 🕵️ **Entity Type** | ', replace(replace(replace(coalesce(body('URL_Analyzer')?['properties']?['entityType'], 'N/A'), '\\r\\n', '\\n'), '\\n', '<br/>'), '|', '\\\\|'), ' |\\n',\r\n'| 🔎 **Analysis Result** | ', replace(replace(replace(replace(coalesce(body('URL_Analyzer')?['analysis'], 'N/A'), '- ', '• '), '\\r\\n', '\\n'), '\\n', '<br/>'), '|', '\\\\|'), ' |\\n',\r\n'| ✅ **Recommendation** | ', replace(replace(replace(coalesce(body('URL_Analyzer')?['recommendation'], 'N/A'), '\\r\\n', '\\n'), '\\n', '<br/>'), '|', '\\\\|'), ' |\\n',\r\n'| ⚠️ **Disclaimer** | 🤖 ', replace(replace(replace(coalesce(body('URL_Analyzer')?['disclaimer'], 'N/A'), '\\r\\n', '\\n'), '\\n', '<br/>'), '|', '\\\\|'), ' |\\n',\r\n'| 📂 **Data Sources** | ', if(equals(empty(body('URL_Analyzer')?['dataSourceList']), true), 'N/A', concat('• ', replace(join(body('URL_Analyzer')?['dataSourceList'], '\\n• '), '\\n', '<br/>'))), ' |'\r\n)"
133-
},
134125
"Add_comment_to_incident_(V3)": {
135126
"runAfter": {
136-
"Compose": [
127+
"URL_Analyzer": [
137128
"Succeeded"
138129
]
139130
},
@@ -147,7 +138,7 @@
147138
"method": "post",
148139
"body": {
149140
"incidentArmId": "@triggerBody()?['IncidentArmID']",
150-
"message": "<p class=\"editor-paragraph\">@{outputs('Compose')}</p>"
141+
"message": "<p class=\"editor-paragraph\"><b><strong class=\"editor-text-bold\">Security Analysis Report</strong></b><br><br><br><b><strong class=\"editor-text-bold\">Analysis ID: </strong></b>@{body('URL_Analyzer')['id']}<br><br><b><strong class=\"editor-text-bold\">Entity Type:</strong></b> Url<br><br><br>🔗 <b><strong class=\"editor-text-bold\">URL Analysis for:</strong></b> @{triggerBody()?['Entity']?['properties']?['Url']}<br><br><br>🏷️ <b><strong class=\"editor-text-bold\">Classification: </strong></b>@{body('URL_Analyzer')?['classification']}<br><br><br>🔍 <b><strong class=\"editor-text-bold\">Analysis Result: </strong></b>@{body('URL_Analyzer')?['analysis']}<br><br><br>✅<b><strong class=\"editor-text-bold\"> Recommendation:</strong></b> @{body('URL_Analyzer')?['recommendation']}<br><br><br>📋 <b><strong class=\"editor-text-bold\">Data Sources:</strong></b> @{body('URL_Analyzer')?['dataSourceList']}<br><br><br>❗ <b><strong class=\"editor-text-bold\">Disclaimer:</strong></b> @{body('URL_Analyzer')?['disclaimer']}</p>"
151142
},
152143
"path": "/Incidents/Comment"
153144
}

‎Solutions/SentinelSOARessentials/ReleaseNotes.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
| **Version** | **Date Modified (DD-MM-YYY)** | **Change History** |
22
|-------------|--------------------------------|--------------------------------------------------------------------------------------------|
3+
| 3.0.5 | 11-12-2025 | Updated the lookback value to 7 days across all three **Logic Apps** and Renamed the Logic App title to "URL Trigger Entity Analyzer".|
34
| 3.0.4 | 17-11-2025 | Added new **playbooks** for the Sentinel SentinelSOARessentials solution. |
45
| 3.0.3 | 30-05-2025 | This upgrade focused on improving **Playbook** functionality, updating documentation, and refining deployment parameters. |
56
| 3.0.2 | 26-10-2023 | Changes for rebranding from Microsoft 365 Defender to Microsoft Defender XDR. |

0 commit comments

Comments
 (0)