JoeSandbox URL Analyis
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Submits a url or set of urls associated with an incident to JoeSandbox for Analyis.
| Attribute | Value |
|---|---|
| Type | Playbook |
| Solution | JoeSandbox |
| Source | View on GitHub |
Additional Documentation
JoeSandbox URL Analysis Playbook
Table of Contents
Overview
When a new Azure Sentinel Incident is created, this playbook gets triggered and performs the following actions:
- It fetches all the URL objects in the Incident.
- Iterates through the URL objects and submits to JoeSanbox for analysis and fetches the results for each URL.
- All the details from JoeSanbox will be added as comments in a tabular format.
Links to deploy Playbook:
- Click on Deploy to Azure
- It will redirect to configuration page
- Please provide the values accordingly
| Fields | Description |
|---|---|
| Subscription | Select the appropriate Azure Subscription |
| Resource Group | Select the appropriate Resource Group |
| Region | Based on Resource Group this will be uto populated |
| Playbook Name | Please provide a playbook name, if needed |
| Workspace ID | Please provide Log Analytics Workspace ID |
| Function App Name | Please provide the JoeSandbox enrichment function app name |
- Once you provide the above values, please click on
Review + createbutton.
Authentication
Authentication methods this connector supports: - API Key authentication
Prerequisites for using and deploying playbook
- A JoeSanbox API Key.
- JoeSandbox CustomConnector
Deployment instructions
- Deploy the playbooks by clicking on "Deploy to Azure" button. This will take you to deploying an ARM Template wizard.
- Fill in the required parameters for deploying the playbook.
- Click "Review + create". Once the validation is successful, click on "Create".
Post-Deployment instructions.
- As a best practice, we have used the Sentinel connection in Logic Apps that use "ManagedSecurityIdentity" permissions. Please refer to this document and provide permissions to the Logic App accordingly.
b. Configurations in Sentinel:
- In Azure Sentinel, analytical rules should be configured to trigger an incident with URL indicators.
- Configure the automation rules to trigger the playbook.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊