AbuseIPDB Enrich Incident By IP Info
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Once a new sentinal incident is created, this playbook gets triggered and performs the following actions: 1. Gets Information from AbuseIPDB by IP`s, provided in the alert custom entities. 2. Enriches the incident with the obtained info.
| Attribute | Value |
|---|---|
| Type | Playbook |
| Solution | AbuseIPDB |
| Source | View on GitHub |
Additional Documentation
AbuseIPDB-EnrichIncidentByIPInfo
## Summary Once a new sentinal incident is created, this playbook gets triggered and performs the following actions: 1. Gets Information from AbuseIPDB by IP`s, provided in the alert custom entities. 2. Enriches the incident with the obtained info.
Prerequisites
- AbuseIPDBAPI Custom Connector has to be deployed prior to the deployment of this playbook under the same subscription.
Deployment instructions
- To deploy the Playbook, click the Deploy to Azure button. This will launch the ARM Template deployment wizard.
- Fill in the required paramteres:
- Playbook Name: Enter the playbook name here
Post-Deployment instructions
a. Authorize connections
Once deployment is complete, authorize each connection.
- Open playbook which has been deployed
- Click API connection on left side blade
- Click the Microsoft Sentinel connection resource
- Click edit API connection
- Click Authorize
- Sign in
- Click Save
- Repeat steps for AbuseIPDBAPI connector API Connection
b. Configurations in Sentinel
- In Microsoft Sentinel, analytical rules should be configured to trigger an incident.
- Configure the automation rules to trigger the playbook.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊