FileHash Enrichment - Virus Total Report - Alert Triggered using Log Ingestion API
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
↑ Back to Content Index
This playbook will take each File Hash entity and query VirusTotal for file report (https://developers.virustotal.com/v3.0/reference#file-info). It will write the results to Log Analytics using the Azure Monitor Logs Ingestion API. This playbook writes VirusTotal file information to the VirusTotalFileInfo_CL table through the Logs Ingestion API, instead of the older VTFileInfo_CL table.
Logic App Connectors
This playbook uses 3 Logic App connectors / built-in actions:
Action parameters (URLs, paths, function IDs)
| Action |
Method |
Endpoint |
Other |
| Alert_-_Get_incident |
get |
/Incidents/subscriptions/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/resourceGroups/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/workspaces/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/alerts/@{encodeURIComponent(triggerBody()?['SystemAlertId'])} |
— |
| Entities_-_Get_FileHashes |
post |
/entities/filehash |
— |
| Add_comment_to_incident_(V3) |
post |
/Incidents/Comment |
— |
| Add_comment_to_incident_(V3)_2 |
post |
/Incidents/Comment |
— |
| Action |
Method |
Endpoint |
Other |
| Retrieve_information_about_a_file |
get |
/api/v3/files/@{encodeURIComponent(items('For_each')?['Value'])} |
— |
http (Built-in)
| Action |
Method |
Endpoint |
Other |
| Send_Data |
post |
@{concat(parameters('DataCollectionEndpointUri'), '/dataCollectionRules/', parameters('DcrImmutableId'), '/streams/', parameters('StreamName'), '?api-version=2023-01-01')} |
— |
| Send_Data_2 |
post |
@{concat(parameters('DataCollectionEndpointUri'), '/dataCollectionRules/', parameters('DcrImmutableId'), '/streams/', parameters('StreamName'), '?api-version=2023-01-01')} |
— |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
↑ Back to Playbooks · Back to VirusTotal