Pure Storage FlashBlade File System Snapshot

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


This playbook gets triggered when a Microsoft Sentinel Incident created for suspicious activity and it takes files system snapshot of specific file systems listed in key vault

Attribute Value
Type Playbook
Solution Pure Storage
Source View on GitHub

Logic App Connectors

This playbook uses 3 Logic App connectors / built-in actions:

Connector / Action Type Connections Actions
azuresentinel Managed 1 2
keyvault Managed 1 2
http Built-in 0 4
Action parameters (URLs, paths, function IDs)

azuresentinel (Managed)

Action Method Endpoint Other
Entities_-_Get_Accounts post /entities/account
Entities_-_Get_IPs post /entities/ip

keyvault (Managed)

Action Method Endpoint Other
Get_secret get /secrets/@{encodeURIComponent(replace(items('IP_Loop')?['Address'], '.', '-'))}/value
Get_FileSystem_list get /secrets/@{encodeURIComponent(concat(replace(items('IP_Loop')?['Address'], '.', '-'),'-filesystem'))}/value

http (Built-in)

Action Method Endpoint Other
Fetching_API_version GET https://@{item()?['Address']}/api/api_version
Retrieving_auth_token POST https://@{item()?['Address']}/api/login
FileSystem_snapshot POST https://@{item()?['Address']}/api/@{last(body('Fetching_API_version')?['versions'])}/file-system-snapshots
Logout_of_the_FlashBlade POST https://@{item()?['Address']}/api/logout

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Playbooks · Back to Pure Storage