Vectra Add Note To Detections

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

This playbook extracts notes from incident comments and adds them to each detection listed in the incident's custom details. If no comment with proper structure is found and Teams is configured, it prompts the user for note input via an Adaptive Card. If Teams is not configured, the playbook exits gracefully with Succeeded status.

Attribute	Value
Type	Playbook
Solution	Vectra XDR
Source	View on GitHub

Logic App Connectors

This playbook uses 5 Logic App connectors / built-in actions:

Connector / Action	Type	Connections	Actions
`azuresentinel`	Managed	1	0
`keyvault`	Managed	1	2
`teams`	Managed	1	0
`http`	Built-in	0	2
`workflow`	Built-in	0	2

Action parameters (URLs, paths, function IDs)

`keyvault` (Managed)

Action	Method	Endpoint	Other
Get_Access_Token_For_Fetching_Notes	get	`/secrets/@{encodeURIComponent('Vectra-Access-Token')}/value`	—
Get_Access_Token_For_Adding_Notes	get	`/secrets/@{encodeURIComponent('Vectra-Access-Token')}/value`	—

`http` (Built-in)

Action	Method	Endpoint	Other
HTTP_Request_To_Fetch_Notes_Of_Detection	GET	`@{variables('base_url')}/api/@{variables('api_version')}/detections/@{int(split(items('For_Each_Detection_ID'), '.')[0])}/notes`	—
HTTP_Request_To_Add_Note_To_Detection	POST	`@{variables('base_url')}/api/@{variables('api_version')}/detections/@{int(split(items('For_Each_Detection_ID'), '.')[0])}/notes`	—

`workflow` (Built-in)

Action	Method	Endpoint	Other
GenerateAccessTokenVectra_For_Fetching_Notes	—	—	workflowId=`[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/',resourceGroup().name,'/providers/Microsoft.Logic/workflows/',trim(parameters('GenerateAccessCredPlaybookName')))]` triggerName=`manual`
GenerateAccessTokenVectra_For_Adding_Notes	—	—	workflowId=`[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/',resourceGroup().name,'/providers/Microsoft.Logic/workflows/',trim(parameters('GenerateAccessCredPlaybookName')))]` triggerName=`manual`

Additional Documentation

📄 Source: VectraAddNoteToDetections/readme.md

Summary

Prerequisites

The Vectra XDR data connector should be configured to create alerts and generate an incident based on entity data in Microsoft Sentinel.
Obtain Key Vault name and Tenant ID where client credentials are stored and using which access token will be generated.
- Create a Key Vault with a unique name.
- Go to Key Vaults → your Key Vault → Overview and copy Directory ID, which will be used as the tenant ID. NOTE: Ensure the Permission model in the Access Configuration of Key Vault is set to 'Vault access policy'.
(Optional) Obtain Teams GroupId and ChannelId if you want the playbook to prompt for notes when no structured comment is found.
- Create a Team with a public channel.
- Click on the three dots (...) next to your newly created Teams channel and select Get link to channel.
- Copy the text from the link between /channel and /, decode it using an online URL decoder, and copy it to use as Channel ID.
- Copy the text of the GroupId parameter from the link to use as GroupId.
Ensure the VectraGenerateAccessToken playbook is deployed before deploying VectraAddNoteToDetections playbook.

Deployment Instructions

To deploy the Playbook, click the Deploy to Azure button. This will launch the ARM Template deployment wizard.
Fill in the required parameters:
- PlaybookName: Enter the playbook name here.
- KeyVaultName: Name of the Key Vault where secrets are stored.
- TenantId: Tenant ID where the Key Vault is located.
- BaseURL: Enter the base URL of your Vectra account.
- TeamsGroupId: (Optional) Enter Id of the Teams Group where the adaptive card will be posted. Leave empty to skip Teams prompts.
- TeamsChannelId: (Optional) Enter Id of the Teams Channel where the adaptive card will be posted. Leave empty to skip Teams prompts.
- GenerateAccessCredPlaybookName: Playbook name which is deployed as part of prerequisites.

Post-Deployment Instructions

a. Authorize connections

Once deployment is complete, authorize each connection.

Go to your logic app → API connections → Select keyvault connection resource.
Go to General → Edit API connection.
Click Authorize.
Sign in.
Click Save.
Repeat steps for other connections (Teams connection if Teams parameters are configured).

b. Add Access Policy in Key Vault

Add access policy for the playbook's managed identity and authorized user to read and write secrets of the Key Vault.

Go to Logic App → your Logic App → Identity → System assigned Managed identity and copy Object (principal) ID.
Go to Key Vaults → your Key Vault → Access policies → Create.
Select all keys & secrets permissions. Click Next.
In the principal section, search by copied Object ID. Click Next.
Click Review + Create.
Repeat steps 2 to 5 to add access policy for the user account used to authorize the connection.

c. Configurations in Microsoft Sentinel

In Microsoft Sentinel, the analytical rule should be configured to trigger an incident based on data ingested from Vectra. Incident should have Entity mapping with detection_id populated in Custom Details.
To manually run the playbook on a particular incident, follow the steps below:
- Go to Microsoft Sentinel → your workspace → Incidents.
- Select an incident.
- In the right pane, click on Actions, and from the dropdown select the Run Playbook option.
- Click on the Run button beside this playbook.

d. Note

In Microsoft Sentinel Incident, the comment should be in the following structure only to be able to extract values from it.
- note: [note_content] (Do not use quotes for note content)
- note: {note_content} (Do not use quotes for note content)
- Single note value is supported from the comment. For multiple note values, use the adaptive card option instead.
If both TeamsGroupId and TeamsChannelId are left empty at deployment, the playbook will exit with Succeeded status when no structured comment is found, instead of prompting via Teams.

[Content truncated...]