Infoblox-IQ-for-TD-Import-Indicators-TI

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

Imports each Indicator of a Microsoft Sentinel Incident triggered by an Infoblox IQ for TD Insight into the ThreatIntelligenceIndicator table. You must run the Infoblox-IQ-for-TD-Get-Insight-Details playbook on a IQ for TD Insight Incident before running this playbook.

Attribute Value
Type Playbook
Solution Infoblox
Source View on GitHub

Logic App Connectors

This playbook uses 2 Logic App connectors / built-in actions:

Connector / Action Type Connections Actions
azuremonitorlogs Managed 1 2
azuresentinel Managed 1 2
Action parameters (URLs, paths, function IDs)

azuremonitorlogs (Managed)

Action Method Endpoint Other
Get_Domains post /queryDataV2 —
Get_IPs post /queryDataV2 —

azuresentinel (Managed)

Action Method Endpoint Other
Threat_Intelligence_-Upload_STIX_Objects(Preview) post /ThreatIntelligence/@{encodeURIComponent(parameters('WorkspaceID'))}/UploadStixObjects/ —
Threat_Intelligence_-Upload_STIX_Objects(Preview)_1 post /ThreatIntelligence/@{encodeURIComponent(parameters('WorkspaceID'))}/UploadStixObjects/ —

Additional Documentation

📄 Source: Infoblox SOC Import Indicators TI/readme.md

Summary

This playbook imports each Indicator of a Microsoft Sentinel Incident triggered by an Infoblox IQ for TD Insight into the ThreatIntelligenceIndicator table you can use as threat intelligence.

You must run the Infoblox-IQ-for-TD-Get-Insight-Details playbook on the IQ for TD Insight Incident before running this playbook.

This playbook can be configured to run automatically when a IQ for TD Insight Incident occurs or run on demand.

Infoblox IQ for TD Import Indicators TI

Prerequisites

  1. Workspace Name
  2. Entra ID Application Secret
  3. Client ID
  4. Tenant ID

Deployment instructions

  1. To deploy the Playbook, click the Deploy to Azure button. This will launch the ARM Template deployment wizard.
  2. Fill in the required parameters:
    • Playbook Name: Enter the playbook name here
    • Workspace Name: Enter workspace name in which Incident is created
    • Entra ID Application Secret: Enter value for Entra ID Application Secret
    • Client ID: Enter value for Application (Client) ID
    • Tenant ID: Enter value for Directory (Tenant) ID

Deploy to Azure Deploy to Azure Gov

Post-Deployment instructions

a. Authorize connections

Once deployment is complete, authorize each connection.

  1. Go to your logic app -> API connections -> Select azuremonitorlogs connection resource
  2. Go to General -> edit API connection
  3. Click Authorize
  4. Sign in
  5. Click Save
  6. Repeat steps for other connections

b. Assign role to this playbook

  1. Go to Log Analytics Workspace → select your workspace → Access Control → Add
  2. Add role assignment
  3. Assignment type: Job function roles -> Add 'Microsoft Sentinel Contributor' as a Role
  4. Members: select managed identity for assigned access to and add your logic app as member
  5. Click on review+assign

c. Configure playbook permissions (required for automation rules to run this playbook)

  1. Go to Microsoft Sentinel → select your workspace → Settings
  2. Select the Settings tab → Playbook permissions → Configure permissions
  3. Select the subscription containing this playbook
  4. Click Apply

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Playbooks · Back to Infoblox