Speculus Incident Enrichment - Playbook

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

Runs on a Microsoft Sentinel incident, looks up every IP entity against the Speculus REST API (single-IP lookup), and posts the full Speculus enrichment (risk score, attribution, scanner/Tor/proxy classification, geo/network context) as an incident comment.

Attribute Value
Type Playbook
Solution Speculus Threat Intelligence
Source View on GitHub

Logic App Connectors

This playbook uses 2 Logic App connectors / built-in actions:

Connector / Action Type Connections Actions
azuresentinel Managed 1 2
http Built-in 0 1
Action parameters (URLs, paths, function IDs)

azuresentinel (Managed)

Action Method Endpoint Other
Entities_-_Get_IPs post /entities/ip —
Add_Enrichment_Comment post /Incidents/Comment —

http (Built-in)

Action Method Endpoint Other
Get_Speculus_Indicator GET @{concat(parameters('SpeculusBaseUrl'), '/v1/objects/', items('For_Each_IP_Entity')?['Address'])} —

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Playbooks · Back to Speculus Threat Intelligence