StratoSecure - Create Azure DevOps Work Item

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

When a Microsoft Sentinel incident is created from a StratoSecure finding, this playbook creates an Azure DevOps Task work item and writes an audit record to StratoSecure_PlaybookRuns_CL. Human approval is always required before the action executes.

Attribute Value
Type Playbook
Solution StratoSecure
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Transformations Ingestion API Lake-Only
StratoSecure_PlaybookRuns_CL ? ✓ ?

Logic App Connectors

This playbook uses 3 Logic App connectors / built-in actions:

Connector / Action Type Connections Actions
azureloganalyticsdatacollector Managed 1 1
azuresentinel Managed 1 0
http Built-in 0 1
Action parameters (URLs, paths, function IDs)

azureloganalyticsdatacollector (Managed)

Action Method Endpoint Other
Action_AuditLog post /api/logs —

http (Built-in)

Action Method Endpoint Other
Action_CreateADOWorkItem POST [variables('HttpEndpoint')] —

Additional Documentation

📄 Source: StratoSecure-CreateADOWorkItem/readme.md

StratoSecure — Create Azure DevOps Work Item

Creates an Azure DevOps Task work item for tracking finding remediation when a Microsoft Sentinel incident is triggered from a StratoSecure finding. The work item is tagged sentinel; stratosecure; appsec with Priority 1.

Prerequisites

Post-Deployment Steps

  1. Grant the Logic App system-assigned managed identity the Microsoft Sentinel Responder role on the Sentinel workspace.
  2. Store the AdoPat in Azure Key Vault and reference it in the parameter.
  3. Verify the AdoOrganization and AdoProject values match your ADO environment.

Parameters

Parameter Type Description
PlaybookName string Logic App resource name
AdoOrganization string Azure DevOps organization name
AdoProject string Azure DevOps project name
AdoPat securestring Personal Access Token with Work Items (Read & Write) scope
LogAnalyticsWorkspaceId string Workspace ID for audit logging
LogAnalyticsWorkspaceKey securestring Workspace primary key for audit logging
RequireApproval bool When true, actions execute only after approval condition evaluates (default: true)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Playbooks · Back to StratoSecure