Update-VIPUsers-Watchlist-from-AzureAD-Group

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


author: Benjamin Kovacevic

Attribute Value
Type Playbook
Solution Standalone Content
Source View on GitHub

Logic App Connectors

This playbook uses 5 Logic App connectors / built-in actions:

Connector / Action Type Connections Actions
azuremonitorlogs Managed 1 2
azuresentinel Managed 1 0
microsoftsentinel Managed 0 3
office365 Managed 1 0
http Built-in 0 4
Action parameters (URLs, paths, function IDs)

azuremonitorlogs (Managed)

Action Method Endpoint Other
Run_query_and_list_results_-_if_user_is_in_VIP_watchlist post /queryData
Run_query_and_list_results_-_Get_VIP_Watchlist_members post /queryData

microsoftsentinel (Managed)

Action Method Endpoint Other
Watchlists_-_Delete_a_watchlist_item delete /Watchlists/subscriptions/@{encodeURIComponent(parameters('SubscriptionID'))}/resourceGroups/@{encodeURIComponent(parameters('ResourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('MicrosoftSentinelWorkspaceID'))}/watchlists/@{encodeURIComponent('VIPUsers')}/watchlistItem/@{encodeURIComponent(items('For_each_VIP_Watchlist_member')?['_DTItemId'])}
Watchlists_-Add_a_new_watchlist_item-_with_SID put /Watchlists/subscriptions/@{encodeURIComponent(parameters('SubscriptionID'))}/resourceGroups/@{encodeURIComponent(parameters('ResourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('MicrosoftSentinelWorkspaceID'))}/watchlists/@{encodeURIComponent('VIPUsers')}/watchlistItem
Watchlists_-Add_a_new_watchlist_item-VIP_Watchlist-_without_SID put /Watchlists/subscriptions/@{encodeURIComponent(parameters('SubscriptionID'))}/resourceGroups/@{encodeURIComponent(parameters('ResourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('MicrosoftSentinelWorkspaceID'))}/watchlists/@{encodeURIComponent('VIPUsers')}/watchlistItem

http (Built-in)

Action Method Endpoint Other
HTTP_-_check_is_the_Watchlist_user_still_member_of_Azure_AD_group POST https://graph.microsoft.com/beta/users/@{items('For_each_VIP_Watchlist_member')?['User Principal Name']}/checkMemberGroups
HTTP_-_does_user_have_SID GET https://graph.microsoft.com/v1.0/users/@{items('For_each_member_of_VIP_Azure_AD_group')?['userPrincipalName']}?$select=onPremisesSecurityIdentifier
HTTP_-_Get_Group_details GET https://graph.microsoft.com/v1.0/groups/@{variables('VIP Group ID')}
HTTP_-_Get_VIP_Azure_AD_Group_Members GET https://graph.microsoft.com/v1.0/groups/@{variables('VIP Group ID')}/members

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Playbooks