Vectra Update Incident Based on Tag And Notify

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

This playbook runs hourly to identify entities with Medium severity incidents, checks for user-defined tags in Vectra, and if found, upgrades the incident severity to High, adds a comment, and sends a notification to a specified MS Teams channel.

Attribute Value
Type Playbook
Solution Vectra XDR
Source View on GitHub

Logic App Connectors

This playbook uses 8 Logic App connectors / built-in actions:

Connector / Action Type Connections Actions
azuremonitorlogs Managed 1 1
azuresentinel Managed 1 0
azuresentinel_1 Managed 0 2
keyvault Managed 1 0
keyvault_3 Managed 0 2
teams Managed 1 1
http Built-in 0 2
workflow Built-in 0 2
Action parameters (URLs, paths, function IDs)

azuremonitorlogs (Managed)

Action Method Endpoint Other
Run_Query_And_List_Incidents_V2_(Preview) post /queryDataV2 —

azuresentinel_1 (Managed)

Action Method Endpoint Other
Add_comment_to_incident_(V3) post /Incidents/Comment —
Update_Incident_Severity_To_High put /Incidents —

keyvault_3 (Managed)

Action Method Endpoint Other
Get_Vectra_Access_Token_For_Account get /secrets/@{encodeURIComponent('Vectra-Access-Token')}/value —
Get_Vectra_Access_Token_For_Host get /secrets/@{encodeURIComponent('Vectra-Access-Token')}/value —

teams (Managed)

Action Method Endpoint Other
Sent_Notification_Message_To_MS_Teams post /beta/teams/conversation/message/poster/Flow bot/location/@{encodeURIComponent('Channel')} —

http (Built-in)

Action Method Endpoint Other
HTTP_Request_To_Fetch_Associated_Account_Entity_Data GET @{variables('base_url')}/api/@{variables('api_version')}/entities —
HTTP_Request_To_Fetch_Host_Entity_Data GET @{variables('base_url')}/api/@{variables('api_version')}/entities —

workflow (Built-in)

Action Method Endpoint Other
GenerateAccessTokenVectra_2 — — workflowId=[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/',resourceGroup().name,'/providers/Microsoft.Logic/workflows/',trim(parameters('GenerateAccessCredPlaybookName')))]
triggerName=manual
GenerateAccessTokenVectra — — workflowId=[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/',resourceGroup().name,'/providers/Microsoft.Logic/workflows/',trim(parameters('GenerateAccessCredPlaybookName')))]
triggerName=manual

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Playbooks · Back to Vectra XDR