Censys Related Infrastructure

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

This playbook retrieves related infrastructure details for Censys entities (hosts, certificates, or web properties) using the Censys Pivot Analysis API. It accepts an IOC Value (hosts, certificates, or web properties) and IOC type as input, creates a pivot analysis job, monitors the job status, retrieves the results, and ingests the related infrastructure data into Azure Log Analytics for further analysis and display data in the dashboard. Learn more about CensEye in the Censys documentation: ht

Attribute Value
Type Playbook
Solution Censys
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Transformations Ingestion API Lake-Only
CensysRelatedInfrastructure_CL 🔶 ? ✓ ?

Additional Documentation

📄 Source: CensysRelatedInfrastructure/readme.md

Summary

This playbook retrieves related infrastructure details for Censys entities (hosts, certificates, or web properties) using the Censys Pivot Analysis API. It accepts an IOC Value (hosts, certificates, or web properties) and IOC type as input, creates a pivot analysis job, monitors the job status, retrieves the results, and ingests the related infrastructure data into Azure Log Analytics for further analysis and display data in the dashboard. Learn more about CensEye in the Censys documentation: https://docs.censys.com/docs/platform-threat-hunting-use-censeye-to-build-detections

Prerequisites

  1. Obtain a Censys API token and store it in Azure Key Vault as a secret named 'Censys-Access-Token'.
  2. Obtain the Censys Organization ID from your Censys platform account.
  3. Create or identify an Azure Key Vault and note its name and Tenant ID.
  4. Ensure you have a Log Analytics Workspace configured for Microsoft Sentinel.
  5. Deploy the Censys Related Infrastructure workbook to use this playbook.

Deployment Instructions

  1. To deploy the Playbook, click the Deploy to Azure button. This will launch the ARM Template deployment wizard.
  2. Fill in the required parameters: * PlaybookName: Enter the playbook name here (default: CensysRelatedInfrastructure). * OrganizationID: Your Censys Organization ID from the Censys platform account settings. * KeyVaultName: Name of the Azure Key Vault where the Censys API token is stored. * TenantId: Azure AD Tenant ID where the Key Vault is located.

Deploy to Azure Deploy to Azure Gov

Post-Deployment Instructions

a. Authorize connections

Once deployment is complete, authorize each connection. 1. Go to your logic app → API connections → Select Key Vault connection resource. 2. Go to General → edit API connection. 3. Click Authorize. 4. Sign in. 5. Click Save. 6. Repeat steps for Log Analytics Data Collector connection.

b. Add Access policy in Keyvault

Add access policy for the playbook's managed identity to read secrets from Key Vault. 1. Go to logic app → your logic app → identity → System assigned Managed identity and copy Object (principal) ID. 2. Go to keyvaults → your keyvault → Access policies → create. 3. Select Get and List permissions for Secrets. Click next. 4. In the principal section, search by copied object ID. Click next. 5. Click review + create.

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Playbooks · Back to Censys