Restrict MDE Ip Address - Entity Triggered

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

This playbook will and generate alert and block threat indicators for the IP entity in MDE for 90 days.

Attribute	Value
Type	Playbook
Solution	MicrosoftDefenderForEndpoint
Source	View on GitHub

Logic App Connectors

This playbook uses 3 Logic App connectors / built-in actions:

Connector / Action	Type	Connections	Actions
azuresentinel	Managed	1	0
azuresentinel_1	Managed	0	1
http	Built-in	0	1

Action parameters (URLs, paths, function IDs)

azuresentinel_1 (Managed)

Action	Method	Endpoint	Other
Add_comment_to_incident_(V3)	post	/Incidents/Comment	—

http (Built-in)

Action	Method	Endpoint	Other
HTTP_-_Alert_And_Block_IP	POST	https://api.securitycenter.windows.com/api/indicators	—

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Playbooks · Back to MicrosoftDefenderForEndpoint