Update-VIPUsers-Watchlist-from-AzureAD-Group
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
↑ Back to Content Index
author: Benjamin Kovacevic
| Attribute |
Value |
| Type |
Playbook |
| Solution |
Standalone Content |
| Source |
View on GitHub |
Logic App Connectors
This playbook uses 5 Logic App connectors / built-in actions:
Action parameters (URLs, paths, function IDs)
| Action |
Method |
Endpoint |
Other |
| Run_query_and_list_results_-_if_user_is_in_VIP_watchlist |
post |
/queryData |
— |
| Run_query_and_list_results_-_Get_VIP_Watchlist_members |
post |
/queryData |
— |
| Action |
Method |
Endpoint |
Other |
| Watchlists_-_Delete_a_watchlist_item |
delete |
/Watchlists/subscriptions/@{encodeURIComponent(parameters('SubscriptionID'))}/resourceGroups/@{encodeURIComponent(parameters('ResourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('MicrosoftSentinelWorkspaceID'))}/watchlists/@{encodeURIComponent('VIPUsers')}/watchlistItem/@{encodeURIComponent(items('For_each_VIP_Watchlist_member')?['_DTItemId'])} |
— |
| Watchlists_-Add_a_new_watchlist_item-_with_SID |
put |
/Watchlists/subscriptions/@{encodeURIComponent(parameters('SubscriptionID'))}/resourceGroups/@{encodeURIComponent(parameters('ResourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('MicrosoftSentinelWorkspaceID'))}/watchlists/@{encodeURIComponent('VIPUsers')}/watchlistItem |
— |
| Watchlists_-Add_a_new_watchlist_item-VIP_Watchlist-_without_SID |
put |
/Watchlists/subscriptions/@{encodeURIComponent(parameters('SubscriptionID'))}/resourceGroups/@{encodeURIComponent(parameters('ResourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('MicrosoftSentinelWorkspaceID'))}/watchlists/@{encodeURIComponent('VIPUsers')}/watchlistItem |
— |
http (Built-in)
| Action |
Method |
Endpoint |
Other |
| HTTP_-_check_is_the_Watchlist_user_still_member_of_Azure_AD_group |
POST |
https://graph.microsoft.com/beta/users/@{items('For_each_VIP_Watchlist_member')?['User Principal Name']}/checkMemberGroups |
— |
| HTTP_-_does_user_have_SID |
GET |
https://graph.microsoft.com/v1.0/users/@{items('For_each_member_of_VIP_Azure_AD_group')?['userPrincipalName']}?$select=onPremisesSecurityIdentifier |
— |
| HTTP_-_Get_Group_details |
GET |
https://graph.microsoft.com/v1.0/groups/@{variables('VIP Group ID')} |
— |
| HTTP_-_Get_VIP_Azure_AD_Group_Members |
GET |
https://graph.microsoft.com/v1.0/groups/@{variables('VIP Group ID')}/members |
— |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
↑ Back to Playbooks