Response on Teams - HaveIBeenPwned

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

This playbook checks if user accounts are breached, sends email to breached user account and closes incident based on action taken by SOC.

Attribute	Value
Type	Playbook
Solution	Standalone Content
Source	View on GitHub

Logic App Connectors

This playbook uses 4 Logic App connectors / built-in actions:

Connector / Action	Type	Connections	Actions
azuresentinel	Managed	1	3
office365	Managed	1	1
teams	Managed	1	0
HaveIBeenPwnedConnector	Custom	1	1

Action parameters (URLs, paths, function IDs)

azuresentinel (Managed)

Action	Method	Endpoint	Other
Update_incident	put	/Incidents	—
Add_comment_to_incident_(V3)	post	/Incidents/Comment	—
Entities_-_Get_Accounts	post	/entities/account	—

office365 (Managed)

Action	Method	Endpoint	Other
Send_an_email_of_breach_information_to_user	post	/v2/Mail	—

HaveIBeenPwnedConnector (Custom)

Action	Method	Endpoint	Other
Get_all_breaches_for_an_account	get	/api/v3/breachedaccount/@{encodeURIComponent(items('For_each_account')?['Name'])}	—

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Playbooks