StratoSecure - Create Exception / Accept Risk

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

When a Microsoft Sentinel incident is triaged as accepted risk, this playbook calls the StratoSecure API to create a 30-day exception for the finding and writes an audit record to StratoSecure_PlaybookRuns_CL. Human approval is always required before the action executes.

Attribute Value
Type Playbook
Solution StratoSecure
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Transformations Ingestion API Lake-Only
StratoSecure_PlaybookRuns_CL ? ✓ ?

Logic App Connectors

This playbook uses 3 Logic App connectors / built-in actions:

Connector / Action Type Connections Actions
azureloganalyticsdatacollector Managed 1 1
azuresentinel Managed 1 0
http Built-in 0 1
Action parameters (URLs, paths, function IDs)

azureloganalyticsdatacollector (Managed)

Action Method Endpoint Other
Action_AuditLog post /api/logs —

http (Built-in)

Action Method Endpoint Other
Action_CreateException POST [variables('HttpEndpoint')] —

Additional Documentation

📄 Source: StratoSecure-CreateException/readme.md

StratoSecure — Create Exception

Creates a risk exception in StratoSecure for accepted risks. When a Microsoft Sentinel incident is triaged as accepted risk, this playbook calls the StratoSecure API to create a 30-day exception for the finding and writes an audit record to StratoSecure_PlaybookRuns_CL.

Prerequisites

Post-Deployment Steps

  1. Grant the Logic App system-assigned managed identity the Microsoft Sentinel Responder role on the Sentinel workspace.
  2. Store the StratoApiKey in Azure Key Vault and reference it in the parameter.
  3. Configure the Sentinel automation rule to trigger this playbook when an incident is set to "Accepted Risk" classification.

Parameters

Parameter Type Description
PlaybookName string Logic App resource name
StratoApiBaseUrl string StratoSecure platform API base URL (default: https://api.stratocode.io)
StratoApiKey securestring StratoSecure API key
LogAnalyticsWorkspaceId string Workspace ID for audit logging
LogAnalyticsWorkspaceKey securestring Workspace primary key for audit logging
RequireApproval bool When true, actions execute only after approval condition evaluates (default: true)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Playbooks · Back to StratoSecure