Skip to main content

Azure - Enrichment

This Playbook is part of the Azure Enrichment and Remediation Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.5.0 and later.

Given the IP address, this playbook enriches Azure Compute, IAM, and User information.

Dependencies#

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks#

This playbook does not use any sub-playbooks.

Integrations#

  • Azure Compute v2
  • Azure Active Directory Identity And Access
  • Azure Active Directory Users

Scripts#

This playbook does not use any scripts.

Commands#

  • azure-vm-get-public-ip-details
  • azure-vm-get-nic-details
  • azure-vm-get-instance-details
  • msgraph-identity-directory-roles-list
  • msgraph-identity-directory-role-members-list
  • msgraph-user-get

Playbook Inputs#


NameDescriptionDefault ValueRequired
AzureIPAzure IP in alertalert.remoteipRequired

Playbook Outputs#


PathDescriptionType
Azure.ComputeAzure Compute information.unknown
Azure.NetworkAzure NIC information.unknown
MSGraphIdentity.RoleMicrosoft Graph Role object that contains role ID and user IDsunknown
AccountMicrosoft Graph User account objects for found user IDs.unknown
MSGraphUserMicrosoft Graph User objects for found user IDs.unknown

Playbook Image#


Azure - Enrichment image