Sentinel as Code - Api COnnections

Question

Hello,&nbsp;I have several JSON templates for Playbooks and Logic apps. I can deploy them successfully with any issues. However, I have to manually authorize API connections used in Sentinel Playbook.&nbsp;Is there a script/solution to authorize API connections without user interaction?

thijs lecomte · Answer

What API connectors are you looking into?

You can create them through an ARM template:
https://github.com/Azure/Azure-Sentinel/blob/master/Playbooks/Close-Incident-ASCAlert/azuredeploy.json

But OAuth API connections that utilize username/passwords require you to authorize user interaction

What connection are you looking into automating?
Happy to look into these with you as I have researched this quite a bit

socinabox · Answer

Thijs Lecomte&nbsp;Do you have a walkthrough for creating a playbook template?I know there are some instructions here:https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks#instructions-for-templatizing-a-playbook&nbsp;&nbsp;But a walkthrough or video example would greatly help.&nbsp;

thijs lecomte · Answer

Hi&nbsp;SocInABox&nbsp;&nbsp;I don't unfortunately...&nbsp;It's a nice idea for a Youtube videoTagging&nbsp;Rod_Trent&nbsp;who might know if something like this exists

rod_trent · Answer

I don't know offhand, but there's been some discussion about this internally. This may be something we need to put together, or supply some better context on how to accomplish the templatizing.

socinabox · Answer

The demo that would really help me would include:- create a simple playbook and export the arm template- is there anything useful in parameters.json that you need?- after renaming template.json to azuredeploy.json, discuss:- parameters - seems to make sense..- variables - when to add variables? Is there a reference list for common variables? Are there specific requirements for these variables? eg. azuread-xxx, auzresentinel-xxx- resources - am I ADDING or MODIFYING resources? Github suggest I'm ADDing resources?- If I have to add resources, then where can I get a list of common resources? I have no idea how to build a resource from scratch w/o a reference to something.&nbsp;In this example demonstrate what variables need to be included in the template:)(note: connections_office365_1_externalid refers to the parameters.json file that was created during the arm template export from Azure)"parameters": {"$connections": {"value": {"office365": {"connectionId": "[parameters('connections_office365_1_externalid')]","connectionName": "office365-1","id": "/subscriptions/&lt;tenant&gt;/providers/Microsoft.Web/locations/eastus/managedApis/office365"}}}}Thanks!!And I've gone through github and picked some playbooks with unique resources that would be useful for practical demonstrations:Advanced-SNOW-Teams-IntegrationClose-SentinelIncident-fromSNOWAutoConnect-ASCSubscriptionsAzureFirewall-AddIPtoTIAllowListBlock-IPs-on-MDATP-Using-GraphSecurityCarbonBlackClose-Incident-ASCAlertClose-Incident-MCASGet-CompromisedPasswordsGet-MDEFileActivityWithin30MinsM365-Security-Posture

Forum Discussion

Sentinel as Code - Api COnnections

6 Replies

Resources