Skip to main content

Azure - Enrichment

This Playbook is part of the Azure Enrichment and Remediation Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.5.0 and later.

Given the IP address, this playbook enriches Azure Compute, Azure asset hierarchy path, IAM, and User information.


This playbook uses the following sub-playbooks, integrations, and scripts.


This playbook does not use any sub-playbooks.


  • Azure Active Directory Identity And Access
  • Azure Active Directory Users
  • Azure Compute v2
  • Azure Resource Graph


This playbook does not use any scripts.


  • azure-rg-query
  • azure-vm-get-public-ip-details
  • azure-vm-get-nic-details
  • azure-vm-get-instance-details
  • msgraph-identity-directory-roles-list
  • msgraph-identity-directory-role-members-list
  • msgraph-user-get

Playbook Inputs#

NameDescriptionDefault ValueRequired
AzureIPAzure IP in alertalert.remoteipRequired

Playbook Outputs#

Azure.ComputeAzure Compute information.unknown
Azure.NetworkAzure NIC information.unknown
MSGraphIdentity.RoleMicrosoft Graph Role object that contains role ID and user IDsunknown
AccountMicrosoft Graph User account objects for found user IDs.unknown
MSGraphUserMicrosoft Graph User objects for found user IDs.unknown
AzureAssetHierarchyAzure Compute Hierarchy Path.unknown

Playbook Image#

Azure - Enrichment image