Forum Discussion
Solved
Add comment to incident with IP information
Greetings everyone!
I am currently trying to set up a playbook that takes the IP from a incident, looks up this ip(ip lookup or other similar services), and places a comment on the incident regarding information about who owns this IP.
I am doing this because there is extensive use of VPN's in the network and i wish to know if the logins occurring e.g. outside of Europe is owned by a known entity, such as Microsoft, or if it's something else.
I do not know much about how the logic apps are configured so any pointers in the right direction is much appreciated.
- Hi
The Azure Sentinel Github page is an awesome resource as it's actively maintained by the Sentinel team.
Here are a few examples:
https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Get-IPReputation
https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Get-GeoFromIpAndTagIncident
https://secureinfra.blog/2020/09/03/how-to-add-geographical-data-for-ip-addresses-to-an-azure-sentinel-incident/
I have been playing around with Logic Apps heavily. So feel free to reply if you are stuck somewhere
- Hi
The Azure Sentinel Github page is an awesome resource as it's actively maintained by the Sentinel team.
Here are a few examples:
https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Get-IPReputation
https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Get-GeoFromIpAndTagIncident
https://secureinfra.blog/2020/09/03/how-to-add-geographical-data-for-ip-addresses-to-an-azure-sentinel-incident/
I have been playing around with Logic Apps heavily. So feel free to reply if you are stuck somewhereWell.. After some trial and error I cannot seem to make this work for me. I've read something about playbooks not necessarily working without the correct permission, you wouldn't happen to know which roles are needed to make functioning playbooks?
P.S. I am currently only assigned a Security Operator role.
stianhoydal If you look at this page: https://docs.microsoft.com/en-us/azure/sentinel/roles#roles-and-allowed-actions, you will notice that to work with Playbooks you need Azure Sentinel Contributor + Logic App Contributor roles.
This looks exactly like what i need. Let's see if i can make it work for my environment. Thank you : )
