Enrich_Sentinel_IPQualityScore_Domain_Reputation
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
This playbook uses the IPQS Fraud and Risk Scoring connector to automatically enrich Domain's found in the Sentinel incidents. This Playbook Template provides the Reputation such as Critical, High Risk, Moderate Risk, Low Risk, Suspicious, Clean based on Risk Score. Learn more about the integration via the https://docs.microsoft.com/connectors/ipqsfraudandriskscor/ or visit https://www.ipqualityscore.com/contact-us to request a trial key.
| Attribute | Value |
|---|---|
| Type | Playbook |
| Solution | IPQualityScore |
| Source | View on GitHub |
Logic App Connectors
This playbook uses 2 Logic App connectors / built-in actions:
| Connector / Action | Type | Connections | Actions |
|---|---|---|---|
azuresentinel |
Managed | 1 | 3 |
ipqsfraudandriskscor |
Managed | 1 | 1 |
Action parameters (URLs, paths, function IDs)
azuresentinel (Managed)
| Action | Method | Endpoint | Other |
|---|---|---|---|
| Entities_-_Get_Hosts | post | /entities/host |
— |
| Add_comment_to_incident_(V3) | post | /Incidents/Comment |
— |
| Alert_-_Get_incident_2 | get | /Incidents/subscriptions/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/resourceGroups/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/workspaces/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/alerts/@{encodeURIComponent(triggerBody()?['SystemAlertId'])} |
— |
ipqsfraudandriskscor (Managed)
| Action | Method | Endpoint | Other |
|---|---|---|---|
| Retrieve_URL_(or)_Domain_reputation_data | post | /url |
— |
Additional Documentation
📄 Source: Enrich_Sentinel_IPQualityScore_Domain_Reputation/readme.md
author: David Mackler, IPQualityScore
This playbook uses the IPQS Fraud and Risk Scoring connector to automatically enrich Domain's found in the Sentinel incidents. This Playbook Template provides the Reputation such as Critical, High Risk, Moderate Risk, Low Risk, Suspicious, Clean based on Risk Score. Learn more about the integration via the https://docs.microsoft.com/connectors/ipqsfraudandriskscor/ or visit https://www.ipqualityscore.com/contact-us to request a trial key.
Sentinel Incident Comments Screenshot
Reputation Threat Metrix
Links to deploy the Enrich_Sentinel_IPQualityScore_Domain_Reputation playbook template:
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊