From 66edb3f0fcc2e39569415e3ce4822075bac95d4b Mon Sep 17 00:00:00 2001 From: Brian Delaney Date: Mon, 16 Dec 2024 11:25:34 -0500 Subject: [PATCH 1/3] update to connector for v2.0.21 --- Connector/connector.json | 45 +++++++++++++++++++++++++++++++++++++--- README.md | 6 +++--- 2 files changed, 45 insertions(+), 6 deletions(-) diff --git a/Connector/connector.json b/Connector/connector.json index 6c58e6a..4485f19 100644 --- a/Connector/connector.json +++ b/Connector/connector.json @@ -30,7 +30,7 @@ } }, "variables": { - "STATConnectorVersion": "2.0.0" + "STATConnectorVersion": "2.0.21" }, "resources": [ { @@ -117,6 +117,36 @@ ], "x-ms-visibility": "advanced" }, + "EnrichAccountsWithMFA": { + "type": "boolean", + "description": "EnrichAccountsWithMFA", + "title": "", + "enum": [ + true, + false + ], + "x-ms-visibility": "advanced" + }, + "EnrichAccountsWithRoles": { + "type": "boolean", + "description": "EnrichAccountsWithRoles", + "title": "", + "enum": [ + true, + false + ], + "x-ms-visibility": "advanced" + }, + "EnrichHostsWithMDE": { + "type": "boolean", + "description": "EnrichHostsWithMDE", + "title": "", + "enum": [ + true, + false + ], + "x-ms-visibility": "advanced" + }, "Body": { "type": "object", "description": "Incident Body or Alert Body", @@ -1237,6 +1267,15 @@ "description": "Instructions to include in the Microsoft Sentinel Task", "x-ms-visibility": "advanced" }, + "Endpoint": { + "type": "string", + "description": "KQL Query Endpoint. Query for Analytics, Search for Basic/Auxiliary Logs.", + "enum": [ + "Query", + "Search" + ], + "x-ms-visibility": "advanced" + }, "BaseModuleBody": { "type": "object", "description": "Body from STAT Base Module", @@ -2019,8 +2058,8 @@ }, "/api/modules/mdca": { "post": { - "summary": "Microsoft Defender for Cloud Apps Module", - "description": "Sentinel Triage AssistanT Module for determining if user entities have investigation priorities in Microsoft Defender for Cloud Apps.", + "summary": "z MDCA (Deprecated)", + "description": "This module has been deprecated due to the removal of the investigation priority score from MDCA", "operationId": "MDCAModule", "parameters": [ { diff --git a/README.md b/README.md index ab579f0..82ff257 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # Microsoft Sentinel Triage AssistanT (STAT) :hospital: -The Microsoft Sentinel Triage AssistanT (STAT) is a Logic Apps Custom Connector that calls on a library of Automation [Modules](/Modules/) that can be used from Incident and alert based Microsoft Sentinel playbooks. This connector and modules simplify automation by moving complex automation tasks into these callable modules so they can be performed consistently and with ease from the Logic Apps Connector. +The Microsoft Sentinel Triage AssistanT (STAT) is a Logic Apps Custom Connector that calls on a library of Automation [Modules](https://github.com/briandelmsft/SentinelAutomationModules/wiki/Modules) that can be used from Incident and alert based Microsoft Sentinel playbooks. This connector and modules simplify automation by moving complex automation tasks into these callable modules so they can be performed consistently and with ease from the Logic Apps Connector. Using the Microsoft Sentinel Triage AssistanT starts by calling the Base Module. This module prepares and enriches Incident and entity data for each of the triage modules which consumes this data. Once the Base Module has been called the triage modules can be used to perform analysis against the entities related to the Microsoft Sentinel incident. These triage modules will return an easy to use, well documented result so you can evaluate the outputs and quickly make decisions about how to handle an incident. @@ -12,6 +12,6 @@ Project goals include: Many of the Microsoft Sentinel playbook templates available today focus on Notification, Incident Enrichment and Remediation. This project focuses on the triage and analysis of an incident to provide additional confidence in the quality of the incident before taking actions. When the incident is determined to be low quality (likely a benign positive), it can be closed or lowered in severity through these automation flows. When the incident is determined to be of higher quality, it can be raised in severity, assigned to an analyst or even trigger a remediation playbook. -The full solution is available for deployment in the [Deployment](/Deploy/) section and additional documentation can be found in the [Wiki](https://github.com/briandelmsft/SentinelAutomationModules/wiki). +Documentation for STAT can be found in the [Wiki](https://github.com/briandelmsft/SentinelAutomationModules/wiki). Deployment information is also availble on the [deployment page](https://github.com/briandelmsft/SentinelAutomationModules/wiki/Deployment). -If you have any questions about this project or would like to provide suggestions to the STAT project maintainers please open an [issue](https://github.com/briandelmsft/SentinelAutomationModules/issues/new/choose). +If you have any questions about this project or would like to provide suggestions to the STAT project maintainers please open an [issue](https://github.com/briandelmsft/SentinelAutomationModules/issues/new/choose) or a [discussion](https://github.com/briandelmsft/SentinelAutomationModules/discussions). From 9f28f6365251812452912439f2f6b0674d686167 Mon Sep 17 00:00:00 2001 From: Brian Delaney Date: Mon, 16 Dec 2024 11:51:55 -0500 Subject: [PATCH 2/3] link update --- Deploy/deployui.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Deploy/deployui.json b/Deploy/deployui.json index 6d54284..7f48fb4 100644 --- a/Deploy/deployui.json +++ b/Deploy/deployui.json @@ -6,7 +6,7 @@ "config": { "isWizard": true, "basics": { - "description": "## Microsoft Sentinel Triage AssistanT (STAT) Deployment\nThe Microsoft Sentinel Triage AssistanT is designed to help build automated triages for Microsoft Sentinel Incidents to optimize the efficiency of your security operations. This deployment will allow you to deploy the necessary resources to use the STAT tool.\n ### Post Deployment \nAfter deploying this template, ensure to run the [GrantPermissions.ps1](https://github.com/briandelmsft/SentinelAutomationModules/blob/statv2_preview/Deploy/GrantPermissions.ps1) script to grant permissions to the STAT modules. It may take up to 15 minutes for the permissions to become effective.", + "description": "## Microsoft Sentinel Triage AssistanT (STAT) Deployment\nThe Microsoft Sentinel Triage AssistanT is designed to help build automated triages for Microsoft Sentinel Incidents to optimize the efficiency of your security operations. This deployment will allow you to deploy the necessary resources to use the STAT tool.\n ### Post Deployment \nAfter deploying this template, ensure to run the [GrantPermissions.ps1](https://github.com/briandelmsft/SentinelAutomationModules/blob/main/Deploy/GrantPermissions.ps1) script to grant permissions to the STAT modules. It may take up to 15 minutes for the permissions to become effective.", "resourceGroup": { "constraints": { "validations": [ From 5a1b9836d6d004f8cc252117c142517e415b75e9 Mon Sep 17 00:00:00 2001 From: Brian Delaney Date: Mon, 16 Dec 2024 16:32:05 -0500 Subject: [PATCH 3/3] Marking MDCA deprecated --- Connector/connector.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Connector/connector.json b/Connector/connector.json index 4485f19..006b946 100644 --- a/Connector/connector.json +++ b/Connector/connector.json @@ -2058,9 +2058,10 @@ }, "/api/modules/mdca": { "post": { - "summary": "z MDCA (Deprecated)", + "summary": "Microsoft Defender for Cloud Apps (Deprecated)", "description": "This module has been deprecated due to the removal of the investigation priority score from MDCA", "operationId": "MDCAModule", + "deprecated": true, "parameters": [ { "name": "body",