[Deprecated] URL Enrichment - Virus Total Domain Report - Incident Triggered
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
↑ Back to Content Index
This playbook will take each URL entity and query VirusTotal for Domain Report (https://developers.virustotal.com/v3.0/reference#domain-info). It will write the results to Log Analytics and add a comment to the incident. NOTE: It uses the legacy HTTP data collector API to ingest the data, which is about to be deprecated, so it is recommended to use the Get-VTDomainReport-Incident-logingestionapi playbook instead.
Tables Used
This content item queries data from the following tables:
Logic App Connectors
This playbook uses 3 Logic App connectors / built-in actions:
Action parameters (URLs, paths, function IDs)
| Action |
Method |
Endpoint |
Other |
| Send_Data |
post |
/api/logs |
— |
| Send_Data_2 |
post |
/api/logs |
— |
| Action |
Method |
Endpoint |
Other |
| Entities_-_Get_URLs |
post |
/entities/url |
— |
| Add_comment_to_incident_(V3) |
post |
/Incidents/Comment |
— |
| Add_comment_to_incident_(V3)_2 |
post |
/Incidents/Comment |
— |
| Action |
Method |
Endpoint |
Other |
| Get_Domain_report |
get |
/api/v3/domains/@{encodeURIComponent(if(greater(length(split(items('For_each')?['Url'], '/')), 2), split(items('For_each')?['Url'], '/')[2], items('For_each')?['Url']))} |
— |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
↑ Back to Playbooks · Back to VirusTotal