Skip to content

Commit 99d8d0d

Browse files
nate-smalls-s1nate-smalls-s1
authored
Merge pull request #23 from thibault-s1/content/new-entra-id-enrichment-workflow
Add Entra ID alert enrichment workflow
2 parents 02c4cd8 + 8bd052b commit 99d8d0d

File tree

2 files changed

+226
-0
lines changed

2 files changed

+226
-0
lines changed

‎workflows/community/Entra ID/[Entra ID} Enrich Entra ID Information from Alert.json‎

Lines changed: 215 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,215 @@
1+
{
2+
"actions": [
3+
{
4+
"action": {
5+
"client_data": {
6+
"collapsed": false,
7+
"dimensions": { "height": 76.0, "width": 256.0 },
8+
"position": { "x": 0.0, "y": 0.0 }
9+
},
10+
"connection_id": null,
11+
"connection_name": null,
12+
"data": {
13+
"action_type": "singularity_response_trigger",
14+
"filter_groups": [
15+
{
16+
"condition": {
17+
"conditions": [
18+
{
19+
"compared_value": "Proofpoint",
20+
"comparison_operator": "equals",
21+
"input_value": "detectionSource.product"
22+
},
23+
{
24+
"compared_value": "NEW",
25+
"comparison_operator": "equals",
26+
"input_value": "status"
27+
}
28+
],
29+
"operator": "and"
30+
},
31+
"event_subtypes": ["CREATE"],
32+
"event_type": "alert",
33+
"is_disabled": false,
34+
"run_automatically": true
35+
}
36+
],
37+
"name": "Singularity Response Trigger"
38+
},
39+
"description": "Trigger the workflow each time a new Proofpoint alert is ingest by the Singularity Platform",
40+
"integration_id": null,
41+
"snippet_version_id": null,
42+
"snippet_workflow_id": null,
43+
"tag": "core_action",
44+
"type": "singularity_response_trigger",
45+
"use_connection_name": false
46+
},
47+
"connected_to": [{ "custom_handle": null, "target": 2 }],
48+
"export_id": 4,
49+
"parent_action": null
50+
},
51+
{
52+
"action": {
53+
"client_data": {
54+
"collapsed": false,
55+
"dimensions": { "height": 76.0, "width": 256.0 },
56+
"position": { "x": 0.0, "y": 176.6772 }
57+
},
58+
"connection_id": null,
59+
"connection_name": null,
60+
"data": {
61+
"action_type": "variable",
62+
"name": "Extract Asset Name",
63+
"variables": [
64+
{
65+
"is_secret": false,
66+
"name": "AssetName",
67+
"value": "{{singularity-response-trigger.data.asset.name}}"
68+
}
69+
],
70+
"variables_scope": "local"
71+
},
72+
"description": "Extract the asset name of the alert",
73+
"integration_id": null,
74+
"snippet_version_id": null,
75+
"snippet_workflow_id": null,
76+
"tag": "core_action",
77+
"type": "variable",
78+
"use_connection_name": false
79+
},
80+
"connected_to": [{ "custom_handle": null, "target": 3 }],
81+
"export_id": 2,
82+
"parent_action": null
83+
},
84+
{
85+
"action": {
86+
"client_data": {
87+
"collapsed": false,
88+
"dimensions": { "height": 76.0, "width": 256.0 },
89+
"position": { "x": 0.0, "y": 353.3544 }
90+
},
91+
"connection_id": "c1e9e8e2-960b-4a3f-9742-4a7cd3c95f91",
92+
"connection_name": "",
93+
"data": {
94+
"action_type": "http_request",
95+
"continue_on_fail": false,
96+
"headers": { "Content-Type": "application/json" },
97+
"method": "get",
98+
"name": "Get Entra ID User",
99+
"parameters": [
100+
{
101+
"parameter_name": "$select",
102+
"parameter_value": "businessPhones,displayName,givenName,jobTitle,mail,mobilePhone,officeLocation,preferredLanguage,surname,userPrincipalName,id,accountEnabled,department,country,lastPasswordChangeDateTime,mailNickname"
103+
}
104+
],
105+
"payload": null,
106+
"proxy_host": null,
107+
"proxy_password": null,
108+
"proxy_port": null,
109+
"proxy_user": null,
110+
"public_action_id": "0b794ce4-c25a-46b9-ab8d-53bce4482828",
111+
"redirect_follow": true,
112+
"retry_on_status_code": null,
113+
"retry_on_status_codes": [500],
114+
"ssl_verification": true,
115+
"timeout": 30,
116+
"url": "{{Connection.protocol}}{{Connection.url}}<@/v1.0/users/@>{{local_var.AssetName}}",
117+
"url_path": null,
118+
"url_prefix": null,
119+
"use_authentication_data": true,
120+
"use_proxy": false
121+
},
122+
"description": "Search for a user based on their ID or user principal name (usually their email address).",
123+
"integration_id": "73475bd9-3762-4f17-aab5-c544ec5ec31b",
124+
"snippet_version_id": null,
125+
"snippet_workflow_id": null,
126+
"tag": "integration",
127+
"type": "http_request",
128+
"use_connection_name": false
129+
},
130+
"connected_to": [{ "custom_handle": null, "target": 1 }],
131+
"export_id": 3,
132+
"parent_action": null
133+
},
134+
{
135+
"action": {
136+
"client_data": {
137+
"collapsed": false,
138+
"dimensions": { "height": 76.0, "width": 256.0 },
139+
"position": { "x": 0.0, "y": 530.0316 }
140+
},
141+
"connection_id": null,
142+
"connection_name": null,
143+
"data": {
144+
"action_type": "variable",
145+
"name": "Build Alert Note",
146+
"variables": [
147+
{
148+
"is_secret": false,
149+
"name": "note",
150+
"value": "\"User {{local_var.AssetName}} is {{get-entra-id-user.body.mailNickname}}\""
151+
}
152+
],
153+
"variables_scope": "local"
154+
},
155+
"description": "Create the alert note into a variable for better usability in the workflow",
156+
"integration_id": null,
157+
"snippet_version_id": null,
158+
"snippet_workflow_id": null,
159+
"tag": "core_action",
160+
"type": "variable",
161+
"use_connection_name": false
162+
},
163+
"connected_to": [{ "custom_handle": null, "target": 0 }],
164+
"export_id": 1,
165+
"parent_action": null
166+
},
167+
{
168+
"action": {
169+
"client_data": {
170+
"collapsed": false,
171+
"dimensions": { "height": 76.0, "width": 256.0 },
172+
"position": { "x": 0.0, "y": 706.7088 }
173+
},
174+
"connection_id": "19bb4784-8237-454e-b6bf-87ac744c51e7",
175+
"connection_name": "",
176+
"data": {
177+
"action_type": "http_request",
178+
"continue_on_fail": false,
179+
"headers": { "Content-Type": "application/json" },
180+
"method": "post",
181+
"name": "Add Note to Alert",
182+
"parameters": [],
183+
"payload": "{\n \"query\": \"mutation AddNoteToAlert { alertTriggerActions(actions: [{ id: \\\"S1/alert/addNote\\\", payload: { note: { value: \\\"{{Function.HTML_ENCODE(local_var.note)}}\\\" } } }], filter: { or: [{ and: [{ fieldId: \\\"id\\\", stringEqual: { value: \\\"{{singularity-response-trigger.data.id}}\\\" } }] }] }) { ... on ActionsTriggered { actions { actionId success { id } failure { id } skip { id } } } } }\"\n}",
184+
"proxy_host": null,
185+
"proxy_password": null,
186+
"proxy_port": null,
187+
"proxy_user": null,
188+
"public_action_id": "c4d87734-41d0-4f0a-890c-6411de0796d3",
189+
"redirect_follow": true,
190+
"retry_on_status_code": null,
191+
"retry_on_status_codes": [500],
192+
"ssl_verification": true,
193+
"timeout": 30,
194+
"url": "{{Connection.protocol}}{{Connection.url}}/web/api/v2.1/unifiedalerts/graphql",
195+
"url_path": "/web/api/v2.0/threats",
196+
"url_prefix": null,
197+
"use_authentication_data": true,
198+
"use_proxy": false
199+
},
200+
"description": "Add a note to a the Proofpoint alert.",
201+
"integration_id": "3e274c5a-f574-462f-8685-5eed98e90fbb",
202+
"snippet_version_id": null,
203+
"snippet_workflow_id": null,
204+
"tag": "integration",
205+
"type": "http_request",
206+
"use_connection_name": false
207+
},
208+
"connected_to": [],
209+
"export_id": 0,
210+
"parent_action": null
211+
}
212+
],
213+
"description": "This workflow provides more information on the target user of a specific Singularity Platform alert (in this case Proofpoint but could be any alert source). It reaches out to Microsoft Entra ID with the target asset information in order to add some alert enrichments through the notes field.",
214+
"name": "Enrich Entra ID Information from Alert"
215+
}

‎workflows/community/Entra ID/metadata.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
metadata_details:
2+
purpose: "Enriching 3rd party alert note with user asset information from Entra ID"
3+
trigger_type: "alert |automatic"
4+
integration_dependency: "Entra ID API for user asset retrieval, requires API key authentication and appropriate permissions. SentinelOne GraphQL API for alert note update, requires API key authentication and appropriate permissions"
5+
expected_actions_per_run: "4-6 depending on log volume and processing requirements"
6+
human_in_the_loop: "no"
7+
required_products: "AI SIEM, Singularity Response, HyperAutomation"
8+
tags: ["entra-id", "identity", "enrichment", "automation"]
9+
version: "v1.0"
10+
author: "Thibault Bougon"
11+
last_updated: "2025-11-27"

0 commit comments

Comments
 (0)