Vectra Static Resolve Assignment

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

This playbook resolves the assignment for an entity in Vectra and adds a note for the assignment when the status of an incident is changed to 'closed', and also it triages all active detections associated with the entity while applying the Microsoft Sentinel incident ID as the triage label.

Attribute Value
Type Playbook
Solution Vectra XDR
Source View on GitHub

Logic App Connectors

This playbook uses 5 Logic App connectors / built-in actions:

Connector / Action Type Connections Actions
azuresentinel Managed 1 0
keyvault Managed 1 4
teams Managed 1 1
http Built-in 0 4
workflow Built-in 0 4
Action parameters (URLs, paths, function IDs)

keyvault (Managed)

Action Method Endpoint Other
Get_Access_Token_For_Account_Entity get /secrets/@{encodeURIComponent('Vectra-Access-Token')}/value —
Get_Access_Token_For_Host_Entity get /secrets/@{encodeURIComponent('Vectra-Access-Token')}/value —
Get_Access_Token_For_Active_Detection get /secrets/@{encodeURIComponent('Vectra-Access-Token')}/value —
Get_Access_Token_For_Resolve_Assignment get /secrets/@{encodeURIComponent('Vectra-Access-Token')}/value —

teams (Managed)

Action Method Endpoint Other
Post_Message_For_No_Open_Assignment_Found_For_Associated_Entity post /beta/teams/conversation/message/poster/Flow bot/location/@{encodeURIComponent('Channel')} —

http (Built-in)

Action Method Endpoint Other
HTTP_Request_To_Fetch_Data_Of_Associated_Account_Entity GET @{variables('base_url')}/api/@{variables('api_version')}/accounts/@{int(variables('entity_id'))} —
HTTP_Request_To_Fetch_Data_Of_Associated_Host_Entity GET @{variables('base_url')}/api/@{variables('api_version')}/hosts/@{int(variables('entity_id'))} —
HTTP_Request_To_Fetch_Active_Detections_For_Associated_Entity GET @{variables('base_url')}/api/@{variables('api_version')}/detections —
HTTP_Request_To_Resolve_Assignment PUT @{variables('base_url')}/api/@{variables('api_version')}/assignments/@{variables('assignment_id')}/resolve —

workflow (Built-in)

Action Method Endpoint Other
GenerateAccessTokenVectra_2 — — workflowId=[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/',resourceGroup().name,'/providers/Microsoft.Logic/workflows/',trim(parameters('GenerateAccessCredPlaybookName')))]
triggerName=manual
GenerateAccessTokenVectra_4 — — workflowId=[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/',resourceGroup().name,'/providers/Microsoft.Logic/workflows/',trim(parameters('GenerateAccessCredPlaybookName')))]
triggerName=manual
GenerateAccessTokenVectra — — workflowId=[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/',resourceGroup().name,'/providers/Microsoft.Logic/workflows/',trim(parameters('GenerateAccessCredPlaybookName')))]
triggerName=manual
GenerateAccessTokenVectra_3 — — workflowId=[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/',resourceGroup().name,'/providers/Microsoft.Logic/workflows/',trim(parameters('GenerateAccessCredPlaybookName')))]
triggerName=manual

Additional Documentation

📄 Source: VectraStaticResolveAssignment/readme.md

Summary

This playbook resolves the assignment for an entity in Vectra and adds a note for the assignment when the status of an incident is changed to 'closed', and also it triages all active detections associated with the entity while applying the Microsoft Sentinel incident ID as the triage label.

Prerequisites

  1. The Vectra XDR data connector should be configured to create alerts and generate an incident based on entity data in Microsoft Sentinel.
  2. Obtain the key vault name and tenantId where client credentials are stored using which access token will be generated.
    • Create a Key Vault with a unique name.
    • Go to Keyvaults → your Key Vault → Overview and copy DirectoryID which will be used as tenantId.
    • NOTE: Ensure the Permission model in the Access Configuration of Key Vault is set to 'Vault access policy'.
  3. Obtain Teams GroupId and ChannelId:
    • Create a Team with a public channel.
    • Click on three dots (...) present on the right side of your newly created teams channel and Get link to the channel.
    • Copy the text from the link between /channel and /, decode it using an online URL decoder and copy it to use as channelId.
    • Copy the text of groupId parameter from the link to use as groupId.
  4. Ensure that VectraGenerateAccessToken playbook is deployed before deploying VectraStaticResolveAssignment playbook.

Deployment Instructions

  1. To deploy the Playbook, click the Deploy to Azure button. This will launch the ARM Template deployment wizard.
  2. Fill in the required parameters:
    • PlaybookName: Enter the playbook name here.
    • KeyVaultName: Name of the Key Vault where secrets are stored.
    • TenantId: Tenant ID where the Key Vault is located.
    • BaseURL: Enter the base URL of your Vectra account.
    • GenerateAccessCredPlaybookName: Playbook name which is deployed as part of prerequisites.
    • TeamsGroupId: Enter Id of the Teams Group where the adaptive card will be posted.
    • TeamsChannelId: Enter Id of the Teams Channel where the adaptive card will be posted.
    • EntityNote: Enter a note you want to add in Vectra Entity for assignment.

Deploy to Azure Deploy to Azure

Post-Deployment Instructions

a. Authorize Connections

Once deployment is complete, authorize each connection.

  1. Go to your logic app → API connections → Select keyvault connection resource.
  2. Go to General → Edit API connection.
  3. Click Authorize.
  4. Sign in.
  5. Click Save.
  6. Repeat steps for other connections.

b. Add Access Policy in Key Vault

Add access policy for the playbook's managed identity and authorized user to read and write secrets of key vault.

  1. Go to logic app → your Logic App → identity → System assigned Managed identity and copy Object (principal) ID.
  2. Go to key vaults → your Key Vault → Access policies → create.
  3. Select all keys & secrets permissions. Click next.
  4. In the principal section, search by copied object ID. Click next.
  5. Click review + create.
  6. Repeat the above steps 2 to 5 to add access policy for the user account using which connection is authorized.

c. Configurations in Microsoft Sentinel

  1. In Microsoft Sentinel, analytical rule should be configured to trigger an incident based on data ingested from Vectra. Incident should have Entity mapping.
  2. In Microsoft Sentinel, Configure the automation rules to trigger the playbook: a. Go to Microsoft Sentinel → your workspace → Automation. b. Click on Create → Automation rule. c. Provide name for your rule. d. Select Trigger as When incident is updated. e. In Incident Status condition, select Status changed to 'Closed'. f. In Actions dropdown select Run playbook. g. In the second dropdown select your deployed playbook. h. Click on Apply. i. Save the Automation rule.

NOTE: If you want to manually run the playbook on a particular incident follow the below steps: a. Go to Microsoft Sentinel → your workspace → Incidents. b. Select an incident. c. In the right pane, click on Actions, and from the dropdown select the 'Run Playbook' option. d. Click on the Run button beside this playbook.

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Playbooks · Back to Vectra XDR