Centralize your security response with Azure Sentinel & PagerDuty

Published 02-03-2021 05:44 AM 6,400 Views

This blog was written in collaboration with @Sebastien Molendijk , thank you for all of your hard work!

 

Security teams today are inundated with alerts and information from a growing number of siloed point solutions. Furthermore, manual processes and cross-team handoffs hinder the security team’s ability to efficiently respond to attacks.

 

Security teams are in dire need of workflows that can shorten the response cycle by enabling automated workflow actions so analysts can focus on remediation and effectively managing the lifecycle of security incidents. PagerDuty is an agile incident management platform that works with IT Operations and DevOps teams to improve operational reliability and agility.

 

In this installment, we will cover the process to integrate and centralize your security response in Azure Sentinel with PagerDuty.

 

visiodiagram.png

 

Figure 1:  High Level flow to integrate Azure Sentinel with PagerDuty

 

Configuration steps

 

In PagerDuty

 

  1. The first step is to create a REST API key. (This API key will be used by Azure Logic Apps to communicate with PagerDuty).
    Go to the “Apps” menu and click on “API Access”.

Figure 1: PagerDuty ConfigurationFigure 1: PagerDuty Configuration2. On the API Access page, select Create New API Key.

 

Figure 2: PagerDuty ConfigutationFigure 2: PagerDuty Configutation

 

3. In the dialog that pops up, you’ll be prompted to enter a Description for your key. You will also have the option to create the key as Read-only; leave this box unchecked as a full-access API key is required.

 

Select the Create Key button to generate the new API key.

 

Figure 3: PagerDuty ConfigurationFigure 3: PagerDuty Configuration

 

 4. Once the key is generated, you will see a dialog displaying your key and confirming the options you filled in on the previous step.

 

Figure 4: PagerDuty ConfigurationFigure 4: PagerDuty Configuration

 

Important: Make sure to copy this key and save it in a secure place, as you will not have access to the key after this step. If you lose a key that you created previously and need access to it again, you should remove the key and create a new one.

 

In Azure

 

We now have to import the Logic App creating the incidents in PagerDuty.

 

  1. Go to GitHub and select the Deploy to Azure button.

Figure 5: Azure ConfigurationFigure 5: Azure Configuration

 

2. Provide the required parameters,  the Azure Sentinel connection name and Resource Group.

 

Figure 6: Azure ConfigurationFigure 6: Azure Configuration

 

3. Once the deployment is complete, go to the resource group to configure the Logic App.

 

Figure 7: Azure ConfigurationFigure 7: Azure Configuration

 

 4. Click on the Edit button to access to the designer.

 

Figure 8: Azure ConfigurationFigure 8: Azure Configuration

 

 5. In the Logic App, configure the API token value, as well as the PagerDuty service ID.
 Note: to increase security, you could store the API token in a Key Vault.

 

azuresteps6.png

 

Test your Logic App

 

To validate that our solution is working as expected, go to Azure Sentinel and open an incident.

  1. In the incident, on the Alerts tab, go to the right of the blade and click on View playbooks

 

Figure 9: Azure ConfigurationFigure 9: Azure Configuration

 

2. Search for the Logic App you just created and click on the Run button.

azuresteps8.png

 

3. Once the execution successfully complete, a new comment with a link to PagerDuty will be added (you might need to click on the refresh button in the incident).

 

azuresteps9.png

 

4. Click on the link in the comment. It will open the incident in PagerDuty.

 

azuresteps10.png

 

 

Putting it all together

 

In this installment, we demonstrated the process to integrate and centralize your security reponse in Azure Sentinel with PagerDuty. This integration will ensure comprehensive mapping of details in the alert to Security Incident artifacts and trigger playbooks in PagerDuty to orchestrate,  triage, investigate and response actions. Additionally, it will enable quality and consistency of security investigations and scales security incident teams.

 

2 Comments

It is funny that Azure Sentinel is security service but you propose a solution where secret is in plain text in the logic app.

Occasional Contributor

Is there a canonical way to secure keys and credentials in logic apps? It would be great if credentials could be defined and automatically stored and retrieved from key vault by using a placeholder.

 

Right now the only way we can secure flow like these are by adding a step to pull from key vault, and then setting all relevant nodes to Secure Inputs/Outputs. Unfortunately that really hampers debugging! Not ideal...

%3CLINGO-SUB%20id%3D%22lingo-sub-2110228%22%20slang%3D%22en-US%22%3ECentralize%20your%20security%20response%20with%20Azure%20Sentinel%20%26amp%3B%20PagerDuty%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2110228%22%20slang%3D%22en-US%22%3E%3CP%3E%3CEM%3EThis%20blog%20was%20written%20in%20collaboration%20with%3C%2FEM%3E%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F143984%22%20target%3D%22_blank%22%3E%40Sebastien%20Molendijk%3C%2FA%3E%26nbsp%3B%2C%20%3CEM%3Et%3C%2FEM%3E%3CEM%3Ehank%20you%20for%20all%20of%20your%20hard%20work!%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ESecurity%20teams%20today%20are%20inundated%20with%20alerts%20and%20information%20from%20a%20growing%20number%20of%20siloed%20point%20solutions.%20Furthermore%2C%20manual%20processes%20and%20cross-team%20handoffs%20hinder%20the%20security%20team%E2%80%99s%20ability%20to%20efficiently%20respond%20to%20attacks.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ESecurity%20teams%20are%20in%20dire%20need%20of%20workflows%20that%20can%20shorten%20the%20response%20cycle%20by%20enabling%20automated%20workflow%20actions%20so%20analysts%20can%20focus%20on%20remediation%20and%20effectively%20managing%20the%20lifecycle%20of%20security%20incidents.%20PagerDuty%20is%20an%20agile%20incident%20management%20platform%20that%20works%20with%20IT%20Operations%20and%20DevOps%20teams%20to%20improve%20operational%20reliability%20and%20agility.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIn%20this%20installment%2C%20we%20will%20cover%20the%20process%20to%20integrate%20and%20centralize%20your%20security%20response%20in%20Azure%20Sentinel%20with%20PagerDuty.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22visiodiagram.png%22%20style%3D%22width%3A%20624px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F251030i7CD90110D216D62E%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22visiodiagram.png%22%20alt%3D%22visiodiagram.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-align-center%22%3E%3CEM%3EFigure%201%3A%26nbsp%3B%20High%20Level%20flow%20to%20integrate%20Azure%20Sentinel%20with%20PagerDuty%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH1%20id%3D%22toc-hId-1269928176%22%20id%3D%22toc-hId-1269928176%22%20id%3D%22toc-hId-1269928176%22%20id%3D%22toc-hId-1269928176%22%20id%3D%22toc-hId-1269928176%22%20id%3D%22toc-hId-1268914169%22%3EConfiguration%20steps%3C%2FH1%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId-1960489650%22%20id%3D%22toc-hId-1960489650%22%20id%3D%22toc-hId-1960489650%22%20id%3D%22toc-hId-1960489650%22%20id%3D%22toc-hId-1960489650%22%20id%3D%22toc-hId-1959475643%22%3EIn%20PagerDuty%3C%2FH2%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3EThe%20first%20step%20is%20to%20create%20a%20REST%20API%20key.%20(This%20API%20key%20will%20be%20used%20by%20Azure%20Logic%20Apps%20to%20communicate%20with%20PagerDuty).%3CBR%20%2F%3EGo%20to%20the%20%E2%80%9CApps%E2%80%9D%20menu%20and%20click%20on%20%E2%80%9CAPI%20Access%E2%80%9D.%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22step1.png%22%20style%3D%22width%3A%20624px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F251031i91BE9BC4A453E562%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22step1.png%22%20alt%3D%22Figure%201%3A%20PagerDuty%20Configuration%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EFigure%201%3A%20PagerDuty%20Configuration%3C%2FSPAN%3E%3C%2FSPAN%3E2.%20On%20the%20API%20Access%20page%2C%20select%20%3CSTRONG%3ECreate%20New%20API%20Key%3C%2FSTRONG%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22STEP2.png%22%20style%3D%22width%3A%20624px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F251037i05AE2E20BD7DDC8A%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22STEP2.png%22%20alt%3D%22Figure%202%3A%20PagerDuty%20Configutation%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EFigure%202%3A%20PagerDuty%20Configutation%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E3.%20In%20the%20dialog%20that%20pops%20up%2C%20you%E2%80%99ll%20be%20prompted%20to%20enter%20a%20Description%20for%20your%20key.%20You%20will%20also%20have%20the%20option%20to%20create%20the%20key%20as%20Read-only%3B%20leave%20this%20box%20unchecked%20as%20a%20full-access%20API%20key%20is%20required.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ESelect%20the%26nbsp%3B%3CSTRONG%3ECreate%20Key%3C%2FSTRONG%3E%20button%20to%20generate%20the%20new%20API%20key.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22step3.png%22%20style%3D%22width%3A%20554px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F251038iF38CC3F9D43F6F69%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22step3.png%22%20alt%3D%22Figure%203%3A%20PagerDuty%20Configuration%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EFigure%203%3A%20PagerDuty%20Configuration%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B4.%20Once%20the%20key%20is%20generated%2C%20you%20will%20see%20a%20dialog%20displaying%20your%20key%20and%20confirming%20the%20options%20you%20filled%20in%20on%20the%20previous%20step.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22step4.png%22%20style%3D%22width%3A%20557px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F251040i7E74C59798938286%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22step4.png%22%20alt%3D%22Figure%204%3A%20PagerDuty%20Configuration%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EFigure%204%3A%20PagerDuty%20Configuration%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CEM%3EImportant%3C%2FEM%3E%3C%2FSTRONG%3E%3CEM%3E%3A%20Make%20sure%20to%20copy%20this%20key%20and%20save%20it%20in%20a%20secure%20place%2C%20as%20you%20will%20not%20have%20access%20to%20the%20key%20after%20this%20step.%20If%20you%20lose%20a%20key%20that%20you%20created%20previously%20and%20need%20access%20to%20it%20again%2C%20you%20should%20remove%20the%20key%20and%20create%20a%20new%20one.%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId-153035187%22%20id%3D%22toc-hId-153035187%22%20id%3D%22toc-hId-153035187%22%20id%3D%22toc-hId-153035187%22%20id%3D%22toc-hId-153035187%22%20id%3D%22toc-hId-152021180%22%3EIn%20Azure%3C%2FH2%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%20now%20have%20to%20import%20the%20Logic%20App%20creating%20the%20incidents%20in%20PagerDuty.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3EGo%20to%20%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2FSebmolendijk%2FPagerDuty%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EGitHub%3C%2FA%3E%20and%20select%20the%20%3CSTRONG%3EDeploy%20to%20Azure%20%3C%2FSTRONG%3Ebutton.%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22azuresteps.png%22%20style%3D%22width%3A%20624px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F251050i58E59A14D38803CF%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22azuresteps.png%22%20alt%3D%22Figure%205%3A%20Azure%20Configuration%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EFigure%205%3A%20Azure%20Configuration%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E2.%26nbsp%3BProvide%20the%20required%20parameters%2C%26nbsp%3B%20the%20Azure%20Sentinel%20connection%20name%20and%20Resource%20Group.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22azurestep2.png%22%20style%3D%22width%3A%20624px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F251052iE88D9630AEA9EF0C%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22azurestep2.png%22%20alt%3D%22Figure%206%3A%20Azure%20Configuration%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EFigure%206%3A%20Azure%20Configuration%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E3.%20Once%20the%20deployment%20is%20complete%2C%20go%20to%20the%20resource%20group%20to%20configure%20the%20Logic%20App.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22Azurestep3.png%22%20style%3D%22width%3A%20468px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F251053i144A21D2B4768632%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Azurestep3.png%22%20alt%3D%22Figure%207%3A%20Azure%20Configuration%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EFigure%207%3A%20Azure%20Configuration%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B4.%20Click%20on%20the%20Edit%20button%20to%20access%20to%20the%20designer.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22azuresteps5.png%22%20style%3D%22width%3A%20624px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F251054i52F5009BEF7F9A6F%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22azuresteps5.png%22%20alt%3D%22Figure%208%3A%20Azure%20Configuration%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EFigure%208%3A%20Azure%20Configuration%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B5.%20In%20the%20Logic%20App%2C%20configure%20the%20API%20token%20value%2C%20as%20well%20as%20the%20PagerDuty%20service%20ID.%3CBR%20%2F%3E%3CEM%3E%26nbsp%3BNote%3C%2FEM%3E%3A%20to%20increase%20security%2C%20you%20could%20store%20the%20API%20token%20in%20a%20Key%20Vault.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22azuresteps6.png%22%20style%3D%22width%3A%20624px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F251056i124903738AB2DE03%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22azuresteps6.png%22%20alt%3D%22azuresteps6.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH1%20id%3D%22toc-hId-142532083%22%20id%3D%22toc-hId-142532083%22%20id%3D%22toc-hId-142532083%22%20id%3D%22toc-hId-142532083%22%20id%3D%22toc-hId-142532083%22%20id%3D%22toc-hId-141518076%22%3ETest%20your%20Logic%20App%3C%2FH1%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20validate%20that%20our%20solution%20is%20working%20as%20expected%2C%20go%20to%20Azure%20Sentinel%20and%20open%20an%20incident.%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3EIn%20the%20incident%2C%20on%20the%20%3CSTRONG%3EAlerts%3C%2FSTRONG%3E%20tab%2C%20go%20to%20the%20right%20of%20the%20blade%20and%20click%20on%20%3CSTRONG%3EView%20playbooks%3C%2FSTRONG%3E%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22azuresteps7.png%22%20style%3D%22width%3A%20708px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F251060iC429747FDC914318%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22azuresteps7.png%22%20alt%3D%22Figure%209%3A%20Azure%20Configuration%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EFigure%209%3A%20Azure%20Configuration%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E2.%20Search%20for%20the%20Logic%20App%20you%20just%20created%20and%20click%20on%20the%20%3CSTRONG%3ERun%3C%2FSTRONG%3E%20button.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22azuresteps8.png%22%20style%3D%22width%3A%20712px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F251061i15E5C4DAE787901F%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22azuresteps8.png%22%20alt%3D%22azuresteps8.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E3.%20Once%20the%20execution%20successfully%20complete%2C%20a%20new%20comment%20with%20a%20link%20to%20PagerDuty%20will%20be%20added%20(you%20might%20need%20to%20click%20on%20the%20refresh%20button%20in%20the%20incident).%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22azuresteps9.png%22%20style%3D%22width%3A%20624px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F251062iB7122AB1D3050C1B%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22azuresteps9.png%22%20alt%3D%22azuresteps9.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E4.%20Click%20on%20the%20link%20in%20the%20comment.%20It%20will%20open%20the%20incident%20in%20PagerDuty.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22azuresteps10.png%22%20style%3D%22width%3A%20624px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F251064i7D73FAA411876A72%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22azuresteps10.png%22%20alt%3D%22azuresteps10.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CDIV%20id%3D%22tinyMceEditorCristhofer%20Munoz_0%22%20class%3D%22mceNonEditable%20lia-copypaste-placeholder%22%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CH2%20id%3D%22toc-hId-833093557%22%20id%3D%22toc-hId-833093557%22%20id%3D%22toc-hId-833093557%22%20id%3D%22toc-hId-833093557%22%20id%3D%22toc-hId-833093557%22%20id%3D%22toc-hId-832079550%22%3EPutting%20it%20all%20together%3C%2FH2%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIn%20this%20installment%2C%20we%20demonstrated%20the%20process%20to%20integrate%20and%20centralize%20your%20security%20reponse%20in%20Azure%20Sentinel%20with%20PagerDuty.%20This%20integration%20will%20ensure%20comprehensive%20mapping%20of%20details%20in%20the%20alert%20to%20Security%20Incident%20artifacts%20and%20trigger%20playbooks%20in%20PagerDuty%20to%20orchestrate%2C%20%26nbsp%3Btriage%2C%20investigate%20and%20response%20actions.%20Additionally%2C%20it%20will%20enable%20quality%20and%20consistency%20of%20security%20investigations%20and%20scales%20security%20incident%20teams.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-2110228%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22Untitled%20design%20(2).png%22%20style%3D%22width%3A%20500px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F251821i5AE3F712773680DE%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Untitled%20design%20(2).png%22%20alt%3D%22Untitled%20design%20(2).png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ESecurity%20teams%20are%20in%20dire%20need%20of%20workflows%20that%20can%20shorten%20the%20response%20cycle%20by%20enabling%20automated%20workflow%20actions%20so%20analysts%20can%20focus%20on%20remediation%20and%20effectively%20managing%20the%20lifecycle%20of%20security%20incidents.%20PagerDuty%20is%20an%20agile%20incident%20management%20platform%20that%20works%20with%20IT%20Operations%20and%20DevOps%20teams%20to%20improve%20operational%20reliability%20and%20agility.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIn%20this%20installment%2C%20we%20will%20cover%20the%20process%20to%20integrate%20and%20centralize%20your%20security%20response%20in%20Azure%20Sentinel%20with%20PagerDuty.%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2136500%22%20slang%3D%22en-US%22%3ERe%3A%20Centralize%20your%20security%20response%20with%20Azure%20Sentinel%20%26amp%3B%20PagerDuty%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2136500%22%20slang%3D%22en-US%22%3E%3CP%3EIt%20is%20funny%20that%20Azure%20Sentinel%20is%20security%20service%20but%20you%20propose%20a%20solution%20where%20secret%20is%20in%20plain%20text%20in%20the%20logic%20app.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2146667%22%20slang%3D%22en-US%22%3ERe%3A%20Centralize%20your%20security%20response%20with%20Azure%20Sentinel%20%26amp%3B%20PagerDuty%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2146667%22%20slang%3D%22en-US%22%3E%3CP%3EIs%20there%20a%20canonical%20way%20to%20secure%20keys%20and%20credentials%20in%20logic%20apps%3F%20It%20would%20be%20great%20if%20credentials%20could%20be%20defined%20and%20automatically%20stored%20and%20retrieved%20from%20key%20vault%20by%20using%20a%20placeholder.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERight%20now%20the%20only%20way%20we%20can%20secure%20flow%20like%20these%20are%20by%20adding%20a%20step%20to%20pull%20from%20key%20vault%2C%20and%20then%20setting%20all%20relevant%20nodes%20to%26nbsp%3BSecure%20Inputs%2FOutputs.%20Unfortunately%20that%20really%20hampers%20debugging!%20Not%20ideal...%3C%2FP%3E%3C%2FLINGO-BODY%3E
Co-Authors
Version history
Last update:
‎Feb 03 2021 05:44 AM
Updated by: