Domain Breach Data - SpyCloud Enterprise
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
The SpyCloud Enterprise API is able to provide breach data for a domain or set of domains associated with an incident.
| Attribute | Value |
|---|---|
| Type | Playbook |
| Solution | SpyCloud Enterprise Protection |
| Source | View on GitHub |
Additional Documentation
📄 Source: SpyCloud-Get-Domain-Breach-Data-Playbook/readme.md
SpyCloud Enterprise Domain Breach Data Playbook
Table of Contents
Overview
The SpyCloud Enterprise API provides breach data for a domain or set of domains associated with an incident. When a new Microsoft Sentinel Incident is created, this playbook gets triggered and performs the following actions:
- It fetches all the DNS entities from the incident.
- Iterates through the domain objects and fetches the breach data from SpyCloud Enterprise for each domain.
- All the breach data from SpyCloud Enterprise will be added as incident comments in a tabular format.
Prerequisites
- A SpyCloud Enterprise API Key.
- SpyCloud Enterprise custom connector needs to be deployed prior to the deployment of this playbook, in the same resource group and region. Relevant instructions can be found on the connector doc page.
Deployment Instructions
- Deploy the playbooks by clicking on the "Deploy to Azure" button. This will take you to the Deploy an ARM Template wizard.
- Fill in the required parameters for deploying the playbook.
- Click "Review + create". Once the validation is successful, click on "Create".
Post-Deployment Instructions
Authorize connections
Once deployment is complete, you will need to authorize each connection:
- As a best practice, we have used the Sentinel connection in Logic Apps that use "ManagedSecurityIdentity" permissions. Please refer to this document and provide permissions to the Logic App accordingly.
- Provide connection details for the SpyCloud Enterprise Custom Connector.
- Save the Logic App. If the Logic App prompts any missing connections, please update the connections similarly.
Configurations in Sentinel:
- In Microsoft Sentinel, analytical rules should be configured to trigger an incident with a DNS entity.
- Configure the automation rules to trigger this playbook.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
↑ Back to Playbooks · Back to SpyCloud Enterprise Protection