AzureKeyVault

Use the Azure Key Vault integration to safeguard and manage cryptographic keys and secrets used by cloud applications and services.

Authentication & Identity Management · Azure Key Vault

Details

IDAzureKeyVault
ProviderMicrosoft
CategoryAuthentication & Identity Management
From Version5.5.0
Docker Imagedemisto/crypto:1.0.0.10120494
Supported ModulesAgentix XSIAM Cloud Posture Security

README

Use the Azure Key Vault integration to safeguard and manage cryptographic keys and secrets used by cloud applications and services.
This integration was integrated and tested with version 2022-07-01 of AzureKeyVault.

Configure Azure Key Vault on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Azure Key Vault.

  3. Click Add instance to create and configure a new integration instance.

    Parameter Required
    Azure Cloud False
    Client ID False
    Client Secret False
    Tenant ID True
    Certificate Thumbprint False
    Private Key False
    Use Azure Managed Identities False
    Azure Managed Identities Client ID False
    Default Subscription ID True
    Default Resource Group Name True
    Fetches credentials False
    Credentials Fetch Mode False
    Key Vault names - comma-separated list of Key Vaults to fetch secrets from. False
    Secret names - comma-separated list of secrets to fetch. False
    Trust any certificate (not secure) False
    Use system proxy settings False

  4. Azure cloud options

    Azure Cloud Description
    Worldwide The publicly accessible Azure Cloud
    US GCC Azure cloud for the USA Government Cloud Community (GCC)
    US GCC-High Azure cloud for the USA Government Cloud Community High (GCC-High)
    DoD Azure cloud for the USA Department of Defense (DoD)
    Germany Azure cloud for the German Government
    China Azure cloud for the Chinese Government
  5. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

azure-key-vault-create-update

Create or update a key vault in the specified subscription. If the Key Vault exists, the updated properties will overwrite the existing ones. Please use azure-key-vault-access-policy-update command if you wish to update the access policy of an existing Key Vault.

Base Command

azure-key-vault-create-update

Input

Argument Name Description Required
vault_name Key Vault name. Required
location Key Vault supported Azure location. The location cannot be changed after the Key Vault is created. Default value is ‘westus’. Possible values are: northcentralus, eastus, northeurope, westeurope, eastasia, southeastasia, eastus2, centralus, southcentralus, westus, japaneast, japanwest, australiaeast, australiasoutheast, brazilsouth, centralindia, southindia, westindia, canadacentral, canadaeast, uksouth, ukwest, westcentralus, westus2, koreacentral, francecentral, australiacentral, uaenorth, southafricanorth, switzerlandnorth, germanywestcentral, norwayeast, westus3, jioindiawest. Optional
sku_name Specify whether the key vault is a standard vault or a premium vault. Default value is ‘standard’. Possible values are: standard, premium. Optional
object_id The object ID of a user, service principal or security group in the Entra ID tenant for the vault. The object ID must be unique for the list of access policies: Any change in the access policy regards that object ID, will override the exists one. To retrieve it navigate in the Azure Portal to App registrations > your registered application > click on manage application in local directory > copy Object ID property. Required
keys Permissions to keys. If the Key Vault exists, you must supply the previous keys’ permissions in order to keep them unchanged. Access policy property. Default value is [get,list,create,update,import,delete,backup,restore,recover]. . Possible values are: get, list, create, update, import, delete, backup, restore, recover, decrypt, encrypt, unwrapKey, wrapKey, verify, sign, purge. Optional
secrets Permissions to secrets. If the Key Vault exists, you must supply the previous secrets’ permissions in order to keep them unchanged. Access policy property. Default value is [get,list,set,delete,backup,restore,recover]. Possible values are: get, list, set, delete, recover, backup, restore, purge. Optional
certificates Permissions to certificates. If the Key Vault exists, you must supply the previous certificate’s permissions in order to keep them unchanged. Access policy property. Default value is [get,list,update,create,import,delete,recover,backup,restore,managecontacts,manageissuers,getissuers,listissuers,setissuers,deleteissuers]. Possible values are: get, list, update, create, import, delete, recover, backup, restore, managecontacts, manageissuers, getissuers, listissuers, setissuers, deleteissuers, purge. Optional
storage Permissions to storage accounts. If the Key Vault exists, you must supply the previous storage’s permissions in order to keep them unchanged. Access policy property. Default value is [get,list,set,delete,backup,restore,recover]. Possible values are: get, list, delete, set, update, regeneratekey, getsas, listsas, deletesas, setsas, recover, backup, restore, purge. Optional
enabled_for_deployment Specifies whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault. If the Key Vault exists, you must supply the previous value in order to keep it the same. Default value is True. Possible values are: true, false. Optional
enabled_for_disk_encryption Specifies whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.If the Key Vault exists, you must supply the previous value in order to keep it the same. Default value is True. Possible values are: true, false. Optional
enabled_for_template_deployment Specifies whether Azure Resource Manager is permitted to retrieve secrets from the key vault. If the Key Vault exists, you must supply the previous value in order to keep it the same. Default value is True. Possible values are: true, false. Optional
default_action The default action when no rule from ip_rules and from vnet_subnet_id match. For example, If no ip_rules and vnet_subnet_id arguments are supplied, the access to the key vault from any IP address or virtual network will be according to the default_action value. If you wish to allow access only from specific virtual network or IP address, use the ip_rules or the vnet_subnet_id arguments. This is only used after the bypass property has been evaluated. Network acl property. Possible values are: Allow, Deny. Optional
bypass Tells what traffic can bypass network rules. This can be ‘AzureServices’ or ‘None’. For example, use ‘AzureServices’ if you wish to give azure services access to key vault, although the default action is ‘Deny’ or the access for a specific IP address. Network acl property. Default value is ‘AzureServices’. Possible values are: AzureServices, None. Optional
vnet_subnet_id Allow accessibility of a vault from a specific virtual network. This argument must be the full resource ID of a virtual network subnet. For example, for the subnet ID “/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1”, you allow access to the Key Vault from subnet1. Network acl property. Optional
ignore_missing_vnet_service_endpoint Specifies whether the Network Resource Provider will ignore the check if parent subnet has serviceEndpoints configured. This allows the configuration for the Key Vault to complete without error before the configuration to the virtual network’s subnet is complete. Once the subnet configuration is complete, the Cosmos account will then be accessible through the configured subnet. Network Acl property. Possible values are: . Default is True. Optional
ip_rules The list of IP address rules. Each rule defines the accessibility of a vault from a specific IP address or IP range. It can be a simple IP address “124.56.78.91” or “124.56.78.0/24” - all addresses that start with 124.56.78. For example, for the IP addresses list: “124.56.78.91,124.56.78.92”, you can access the Key Vault from “124.56.78.91” or “124.56.78.92” IP addresses. Network acl property.  
subscription_id The subscription ID. Note: This argument will override the instance parameter ‘Subscription ID’. Optional
resource_group_name The resource group name. Note: This argument will override the instance parameter ‘Resource Group Name’. Optional

Context Output

Path Type Description
AzureKeyVault.KeyVault.id String Resource ID.
AzureKeyVault.KeyVault.name String Key Vault name.
AzureKeyVault.KeyVault.type String Resource type in Azure.
AzureKeyVault.KeyVault.location String Key Vault location.
AzureKeyVault.KeyVault.properties.sku.family String SKU family name.
AzureKeyVault.KeyVault.properties.sku.name String SKU name to specify whether the key vault is a standard vault or a premium vault.
AzureKeyVault.KeyVault.properties.tenantId String The Entra ID tenant ID that should be used for authenticating requests to the key vault.
AzureKeyVault.KeyVault.properties.accessPolicies.tenantId String The Entra ID tenant ID that should be used for authenticating requests to the key vault.
AzureKeyVault.KeyVault.properties.accessPolicies.objectId String The object ID of a user, service principal or security group in the Entra ID tenant for the vault. The object ID must be unique for the list of access policies.
AzureKeyVault.KeyVault.properties.accessPolicies.permissions.keys Unknown Permissions to keys.
AzureKeyVault.KeyVault.properties.accessPolicies.permissions.secrets Unknown Permissions to secrets.
AzureKeyVault.KeyVault.properties.accessPolicies.permissions.certificates Unknown Permissions to certificates.
AzureKeyVault.KeyVault.properties.enabledForDeployment Boolean Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
AzureKeyVault.KeyVault.properties.enabledForDiskEncryption Boolean Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
AzureKeyVault.KeyVault.properties.enabledForTemplateDeployment Boolean Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
AzureKeyVault.KeyVault.properties.vaultUri String The URI of the vault for performing operations on keys and secrets.
AzureKeyVault.KeyVault.properties.provisioningState String The current provisioning state.

Command Example

!azure-key-vault-create-update object_id=YOUR_OBJECT_ID vault_name=xsoar-test-285 keys=create,decrypt

Context Example

{
    "AzureKeyVault": {
        "KeyVault": {
            "id": "/subscriptions/SUBSCRIPTION_ID/resourceGroups/test-group/providers/Microsoft.KeyVault/vaults/xsoar-test-285",
            "location": "westus",
            "name": "xsoar-test-285",
            "properties": {
                "accessPolicies": [
                    {
                        "objectId": "YOUR_OBJECT_ID",
                        "permissions": {
                            "certificates": [
                                "get",
                                "list",
                                "update",
                                "create",
                                "import",
                                "delete",
                                "recover",
                                "backup",
                                "restore",
                                "managecontacts",
                                "manageissuers",
                                "getissuers",
                                "listissuers",
                                "setissuers",
                                "deleteissuers"
                            ],
                            "keys": [
                                "create",
                                "decrypt"
                            ],
                            "secrets": [
                                "get",
                                "list",
                                "set",
                                "delete",
                                "recover",
                                "backup",
                                "restore"
                            ],
                            "storage": [
                                "get",
                                "list",
                                "delete",
                                "set",
                                "update",
                                "regeneratekey",
                                "getsas",
                                "listsas"
                            ]
                        },
                        "tenantId": "YOUR_TENANT_ID"
                    }
                ],
                "enableSoftDelete": true,
                "enabledForDeployment": true,
                "enabledForDiskEncryption": true,
                "enabledForTemplateDeployment": true,
                "provisioningState": "Succeeded",
                "sku": {
                    "family": "A",
                    "name": "standard"
                },
                "tenantId": "YOUR_TENANT_ID",
                "vaultUri": "https://xsoar-test-285.vault.azure.net/"
            },
            "tags": {},
            "type": "Microsoft.KeyVault/vaults"
        }
    }
}

Human Readable Output

xsoar-test-285 Information

Id Name Type Location
/subscriptions/SUBSCRIPTION_ID/resourceGroups/test-group/providers/Microsoft.KeyVault/vaults/xsoar-test-285 xsoar-test-285 Microsoft.KeyVault/vaults westus

azure-key-vault-delete

Delete the specified key vault.

Base Command

azure-key-vault-delete

Input

Argument Name Description Required
vault_name Key Vault name to delete. Required
subscription_id The subscription ID. Note: This argument will override the instance parameter ‘Subscription ID’. Optional
resource_group_name The resource group name. Note: This argument will override the instance parameter ‘Resource Group Name’. Optional

Context Output

There is no context output for this command.

Command Example

!azure-key-vault-delete vault_name=xsoar-test-262

Human Readable Output

Deleted Key Vault xsoar-test-262 successfully.

azure-key-vault-get

Get the specified key vault.

Base Command

azure-key-vault-get

Input

Argument Name Description Required
vault_name Key Vault name. Required
subscription_id The subscription ID. Note: This argument will override the instance parameter ‘Subscription ID’. Optional
resource_group_name The resource group name. Note: This argument will override the instance parameter ‘Resource Group Name’. Optional

Context Output

Path Type Description
AzureKeyVault.KeyVault.id String Resource ID.
AzureKeyVault.KeyVault.name String Key Vault name.
AzureKeyVault.KeyVault.type String Resource type in Azure.
AzureKeyVault.KeyVault.location String Key Vault location.
AzureKeyVault.KeyVault.properties.sku.family String SKU family name.
AzureKeyVault.KeyVault.properties.sku.name String SKU name to specify whether the key vault is a standard vault or a premium vault.
AzureKeyVault.KeyVault.properties.tenantId String The Entra ID tenant ID that should be used for authenticating requests to the key vault.
AzureKeyVault.KeyVault.properties.accessPolicies.tenantId String The Entra ID tenant ID that should be used for authenticating requests to the key vault.
AzureKeyVault.KeyVault.properties.accessPolicies.objectId String The object ID of a user, service principal or security group in the Entra ID tenant for the vault. The object ID must be unique for the list of access policies.
AzureKeyVault.KeyVault.properties.accessPolicies.permissions.keys Unknown Permissions to keys.
AzureKeyVault.KeyVault.properties.accessPolicies.permissions.secrets Unknown Permissions to secrets.
AzureKeyVault.KeyVault.properties.accessPolicies.permissions.certificates Unknown Permissions to certificates.
AzureKeyVault.KeyVault.properties.enabledForDeployment Boolean Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
AzureKeyVault.KeyVault.properties.enabledForDiskEncryption Boolean Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
AzureKeyVault.KeyVault.properties.enabledForTemplateDeployment Boolean Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
AzureKeyVault.KeyVault.properties.enableSoftDelete Boolean Property to specify whether the ‘soft delete’ functionality is enabled for this key vault. If it’s not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
AzureKeyVault.KeyVault.properties.vaultUri String The URI of the vault for performing operations on keys and secrets. This property is readonly.

Command Example

!azure-key-vault-get vault_name=xsoar-test-vault

Context Example

{
    "AzureKeyVault": {
        "KeyVault": {
            "id": "/subscriptions/SUBSCRIPTION_ID/resourceGroups/test-group/providers/Microsoft.KeyVault/vaults/xsoar-test-vault",
            "location": "eastus",
            "name": "xsoar-test-vault",
            "properties": {
                "accessPolicies": [
                    {
                        "objectId": "YOUR_OBJECT_ID",
                        "permissions": {
                            "certificates": [
                                "Get",
                                "List",
                                "Update",
                                "Create",
                                "Import",
                                "Delete",
                                "Recover",
                                "Backup",
                                "Restore",
                                "ManageContacts",
                                "ManageIssuers",
                                "GetIssuers",
                                "ListIssuers",
                                "SetIssuers",
                                "DeleteIssuers",
                                "Purge"
                            ],
                            "keys": [
                                "Get",
                                "List",
                                "Update",
                                "Create",
                                "Import",
                                "Delete",
                                "Recover",
                                "Backup",
                                "Restore",
                                "Decrypt",
                                "Encrypt",
                                "UnwrapKey",
                                "WrapKey",
                                "Verify",
                                "Sign",
                                "Purge"
                            ],
                            "secrets": [
                                "Get",
                                "List",
                                "Set",
                                "Delete",
                                "Recover",
                                "Backup",
                                "Restore",
                                "Purge"
                            ]
                        },
                        "tenantId": "YOUR_TENANT_ID"
                    }
                ],
                "enableRbacAuthorization": false,
                "enableSoftDelete": true,
                "enabledForDeployment": false,
                "enabledForDiskEncryption": false,
                "enabledForTemplateDeployment": false,
                "provisioningState": "Succeeded",
                "sku": {
                    "family": "A",
                    "name": "Standard"
                },
                "softDeleteRetentionInDays": 90,
                "tenantId": "YOUR_TENANT_ID",
                "vaultUri": "https://xsoar-test-vault.vault.azure.net/"
            },
            "tags": {},
            "type": "Microsoft.KeyVault/vaults"
        }
    }
}

Human Readable Output

xsoar-test-vault Information

Id Name Type Location
/subscriptions/SUBSCRIPTION_ID/resourceGroups/test-group/providers/Microsoft.KeyVault/vaults/xsoar-test-vault xsoar-test-vault Microsoft.KeyVault/vaults eastus

azure-key-vault-list

The List operation gets information about the vaults associated with the subscription. For a limit greater than 25, more than one API call will be required and the command might take longer time.

Base Command

azure-key-vault-list

Input

Argument Name Description Required
limit Limit on the number of keys vaults to return. Default value is 50. Optional
offset First index to retrieve from. Default value is 0. Optional
subscription_id The subscription ID. Note: This argument will override the instance parameter ‘Subscription ID’. Optional

Context Output

Path Type Description
AzureKeyVault.KeyVault.id String Resource ID.
AzureKeyVault.KeyVault.name String Key Vault name.
AzureKeyVault.KeyVault.type String Resource type in Azure.
AzureKeyVault.KeyVault.location String Key Vault location.
AzureKeyVault.KeyVault.properties.sku.family String SKU family name.
AzureKeyVault.KeyVault.properties.sku.name String SKU name to specify whether the key vault is a standard vault or a premium vault.
AzureKeyVault.KeyVault.properties.tenantId String The Entra ID tenant ID that should be used for authenticating requests to the key vault.
AzureKeyVault.KeyVault.properties.accessPolicies.tenantId String The Entra ID tenant ID that should be used for authenticating requests to the key vault.
AzureKeyVault.KeyVault.properties.accessPolicies.objectId String The object ID of a user, service principal or security group in the Entra ID tenant for the vault. The object ID must be unique for the list of access policies.
AzureKeyVault.KeyVault.properties.accessPolicies.permissions.keys Unknown Permissions to keys.
AzureKeyVault.KeyVault.properties.accessPolicies.permissions.secrets Unknown Permissions to secrets.
AzureKeyVault.KeyVault.properties.accessPolicies.permissions.certificates Unknown Permissions to certificates.
AzureKeyVault.KeyVault.properties.enabledForDeployment Boolean Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
AzureKeyVault.KeyVault.properties.enabledForDiskEncryption Boolean Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
AzureKeyVault.KeyVault.properties.enabledForTemplateDeployment Boolean Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
AzureKeyVault.KeyVault.properties.enableSoftDelete Boolean Property to specify whether the ‘soft delete’ functionality is enabled for this key vault. If it’s not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
AzureKeyVault.KeyVault.properties.vaultUri String The URI of the vault for performing operations on keys and secrets.

Command Example

!azure-key-vault-list limit=1

Context Example

{
    "AzureKeyVault": {
        "KeyVault": {
            "id": "/subscriptions/SUBSCRIPTION_ID/resourceGroups/test-group/providers/Microsoft.KeyVault/vaults/xsoar-test-265",
            "location": "eastasia",
            "name": "xsoar-test-265",
            "properties": {
                "accessPolicies": [
                    {
                        "objectId": "YOUR_OBJECT_ID",
                        "permissions": {
                            "certificates": [
                                "get",
                                "list",
                                "update",
                                "create",
                                "import",
                                "delete",
                                "recover",
                                "backup",
                                "restore",
                                "managecontacts",
                                "manageissuers",
                                "getissuers",
                                "listissuers",
                                "setissuers",
                                "deleteissuers"
                            ],
                            "keys": [
                                "get",
                                "list",
                                "update",
                                "create",
                                "import",
                                "delete",
                                "recover",
                                "backup",
                                "restore",
                                "decrypt"
                            ],
                            "secrets": [
                                "get",
                                "list",
                                "set",
                                "delete",
                                "recover",
                                "backup",
                                "restore"
                            ],
                            "storage": [
                                "get",
                                "list",
                                "delete",
                                "set",
                                "update",
                                "regeneratekey",
                                "getsas",
                                "listsas"
                            ]
                        },
                        "tenantId": "YOUR_TENANT_ID"
                    }
                ],
                "enableSoftDelete": true,
                "enabledForDeployment": true,
                "enabledForDiskEncryption": true,
                "enabledForTemplateDeployment": true,
                "provisioningState": "Succeeded",
                "sku": {
                    "family": "A",
                    "name": "standard"
                },
                "tenantId": "YOUR_TENANT_ID",
                "vaultUri": "https://xsoar-test-265.vault.azure.net/"
            },
            "tags": {},
            "type": "Microsoft.KeyVault/vaults"
        }
    }
}

Human Readable Output

Key Vaults List

Id Name Type Location
/subscriptions/SUBSCRIPTION_ID/resourceGroups/test-group/providers/Microsoft.KeyVault/vaults/xsoar-test-265 xsoar-test-265 Microsoft.KeyVault/vaults eastasia

azure-key-vault-access-policy-update

Update access policies in a key vault in the specified subscription. The update regards only the access policy for the specified object ID.

Base Command

azure-key-vault-access-policy-update

Input

Argument Name Description Required
vault_name The name of the Key Vault to update it’s access policy. Required
operation_kind The name of the operation to do on the vault’s access policy. Supports three operations: add,remove,replace. For example, to add get, list permissions to the current secret permissions, use operation_kind=add and secrets=get,list. Possible values are: add, remove, replace. Required
object_id The object ID of a user, service principal or security group in the Entra ID tenant for the vault. The update regards only the access policy for the specified object ID. Required
keys Permissions to keys. Possible values are: encrypt, decrypt, wrapKey, unwrapKey, sign, verify, get, list, create, update, import, delete, backup, restore, recover, purge. Optional
secrets Permissions to secrets. Possible values are: get, list, set, delete, backup, restore, recover, purge. Optional
certificates Permissions to certificates. Possible values are: get, list, delete, create, import, update, managecontacts, getissuers, listissuers, setissuers, deleteissuers, manageissuers, recover, purge. Optional
storage Permissions to storage accounts. Possible values are: get, list, delete, set, update, regeneratekey, getsas, listsas, deletesas, setsas, recover, backup, restore, purge. Optional
subscription_id The subscription ID. Note: This argument will override the instance parameter ‘Subscription ID’. Optional
resource_group_name The resource group name. Note: This argument will override the instance parameter ‘Resource Group Name’. Optional

Context Output

Path Type Description
AzureKeyVault.VaultAccessPolicy.id String Resource ID.
AzureKeyVault.VaultAccessPolicy.type String Resource type in Azure.
AzureKeyVault.VaultAccessPolicy.properties.accessPolicies.tenantId String The Entra ID tenant ID that should be used for authenticating requests to the key vault.
AzureKeyVault.VaultAccessPolicy.properties.accessPolicies.objectId String The object ID of a user, service principal or security group in the Entra ID tenant for the vault. The object ID must be unique for the list of access policies.
AzureKeyVault.VaultAccessPolicy.properties.accessPolicies.permissions.keys Unknown Permissions to keys.
AzureKeyVault.VaultAccessPolicy.properties.accessPolicies.permissions.secrets Unknown Permissions to secrets.
AzureKeyVault.VaultAccessPolicy.properties.accessPolicies.permissions.certificates Unknown Permissions to certificates.

Command Example

!azure-key-vault-access-policy-update object_id=YOUR_OBJECT_ID operation_kind=add vault_name=xsoar-test-285 keys=import,list

Context Example

{
    "AzureKeyVault": {
        "VaultAccessPolicy": {
            "id": "/subscriptions/SUBSCRIPTION_ID/resourceGroups/test-group/providers/Microsoft.KeyVault/vaults/xsoar-test-285/accessPolicies/",
            "properties": {
                "accessPolicies": [
                    {
                        "objectId": "YOUR_OBJECT_ID",
                        "permissions": {
                            "certificates": [
                                "get",
                                "list",
                                "update",
                                "create",
                                "import",
                                "delete",
                                "recover",
                                "backup",
                                "restore",
                                "managecontacts",
                                "manageissuers",
                                "getissuers",
                                "listissuers",
                                "setissuers",
                                "deleteissuers"
                            ],
                            "keys": [
                                "create",
                                "decrypt",
                                "import",
                                "list"
                            ],
                            "secrets": [
                                "get",
                                "list",
                                "set",
                                "delete",
                                "recover",
                                "backup",
                                "restore"
                            ],
                            "storage": [
                                "get",
                                "list",
                                "delete",
                                "set",
                                "update",
                                "regeneratekey",
                                "getsas",
                                "listsas"
                            ]
                        },
                        "tenantId": "YOUR_TENANT_ID"
                    }
                ]
            },
            "type": "Microsoft.KeyVault/vaults/accessPolicies"
        }
    }
}

Human Readable Output

xsoar-test-285 Updated Access Policy

Id Type
/subscriptions/SUBSCRIPTION_ID/resourceGroups/test-group/providers/Microsoft.KeyVault/vaults/xsoar-test-285/accessPolicies/ Microsoft.KeyVault/vaults/accessPolicies

azure-key-vault-key-get

Get the public part of a stored key. This operation requires the keys/get permission.

Base Command

azure-key-vault-key-get

Input

Argument Name Description Required
vault_name The name of the Key Vault where the key resides in. Required
key_name Key name. Required
key_version Adding the version parameter retrieves a specific version of a key. This URI fragment is optional. If not specified, the latest version of the key is returned. Optional

Context Output

Path Type Description
AzureKeyVault.Key.key.kid String Key identifier.
AzureKeyVault.Key.key.kty String JsonWebKey Key Type.
AzureKeyVault.Key.key.key_ops Unknown Supported key operations.
AzureKeyVault.Key.key.n String RSA modulus.
AzureKeyVault.Key.key.e String RSA public exponent.
AzureKeyVault.Key.attributes.enabled Boolean Determines whether the object is enabled.
AzureKeyVault.Key.attributes.created Date Creation time in UTC.
AzureKeyVault.Key.attributes.updated Date Last updated time in UTC.
AzureKeyVault.Key.attributes.recoveryLevel Unknown Reflects the deletion recovery level currently in effect for keys in the current vault. If it contains ‘Purgeable’ the key can be permanently deleted by a privileged user; otherwise, only the system can purge the key, at the end of the retention interval.

Command Example

!azure-key-vault-key-get key_name=test-key-1 vault_name=xsoar-test-vault

Context Example

{
    "AzureKeyVault": {
        "Key": {
            "attributes": {
                "created": "2021-08-11T12:03:16",
                "enabled": true,
                "recoverableDays": 90,
                "recoveryLevel": "Recoverable+Purgeable",
                "updated": "2021-08-11T12:03:16"
            },
            "key": {
                "e": "AQAB",
                "key_ops": [
                    "sign",
                    "verify",
                    "wrapKey",
                    "unwrapKey",
                    "encrypt",
                    "decrypt"
                ],
                "kid": "https://xsoar-test-vault.vault.azure.net/keys/test-key-1/KEY_VERSION",
                "kty": "RSA",
                "n": "XXX-XXXX-XXX"
            },
            "key_vault_name": "xsoar-test-vault",
            "tags": {}
        }
    }
}

Human Readable Output

test-key-1 Information

Key Id Enabled Json Web Key Type Key Operations Create Time Update Time
https://xsoar-test-vault.vault.azure.net/keys/test-key-1/KEY_VERSION true RSA sign,
verify,
wrapKey,
unwrapKey,
encrypt,
decrypt		 2021-08-11T12:03:16 2021-08-11T12:03:16

azure-key-vault-key-list

List keys in the specified vault. For a limit greater than 25, more than one API call will be required and the command might take longer time. This operation requires the keys/list permission.

Base Command

azure-key-vault-key-list

Input

Argument Name Description Required
vault_name The name of the Key Vault where the keys reside in. Required
limit Limit on the number of keys to return. Default value is 50. Default is 50. Optional
offset First index to retrieve from. Default value is 0. Default is 0. Optional

Context Output

Path Type Description
AzureKeyVault.Key.kid String Key identifier.
AzureKeyVault.Key.attributes.enabled Boolean Determines whether the object is enabled.
AzureKeyVault.Key.attributes.created Date Creation time in UTC.
AzureKeyVault.Key.attributes.updated Date Last updated time in UTC.
AzureKeyVault.Key.attributes.recoveryLevel String Reflects the deletion recovery level currently in effect for keys in the current vault. If it contains ‘Purgeable’ the key can be permanently deleted by a privileged user; otherwise, only the system can purge the key, at the end of the retention interval.
AzureKeyVault.Key.attributes.recoverableDays Number Soft Delete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0.

Command Example

!azure-key-vault-key-list vault_name=xsoar-test-vault limit=1

Context Example

{
    "AzureKeyVault": {
        "Key": {
            "attributes": {
                "created": "2021-08-11T12:05:48",
                "enabled": false,
                "exp": "2022-08-11T12:05:48",
                "nbf": "2021-08-11T11:55:48",
                "recoverableDays": 90,
                "recoveryLevel": "Recoverable+Purgeable",
                "updated": "2021-09-05T14:02:13"
            },
            "key_vault_name": "xsoar-test-vault",
            "kid": "https://xsoar-test-vault.vault.azure.net/keys/test-cer-1",
            "managed": true,
            "tags": {}
        }
    }
}

Human Readable Output

xsoar-test-vault Keys List

Key Id Enabled Create Time Update Time Expiry Time
https://xsoar-test-vault.vault.azure.net/keys/test-cer-1 false 2021-08-11T12:05:48 2021-09-05T14:02:13 2022-08-11T12:05:48

azure-key-vault-key-delete

Delete a key of any type from storage in Azure Key vault. This operation requires the keys/delete permission.

Base Command

azure-key-vault-key-delete

Input

Argument Name Description Required
vault_name The name of the Key Vault where the key resides in. Required
key_name Key name to delete. Required

Context Output

Path Type Description
AzureKeyVault.Key.recoveryId String The url of the recovery object, used to identify and recover the deleted key.
AzureKeyVault.Key.deletedDate Date The time when the key was deleted, in UTC.
AzureKeyVault.Key.key.kid String Key identifier.
AzureKeyVault.Key.key.kty String JsonWebKey Key Type.
AzureKeyVault.Key.key.key_ops Unknown Supported key operations.
AzureKeyVault.Key.key.n String RSA modulus.
AzureKeyVault.Key.key.e String RSA public exponent.
AzureKeyVault.Key.attributes.enabled Boolean Determines whether the object is enabled.
AzureKeyVault.Key.attributes.created Number Creation time in UTC.
AzureKeyVault.Key.attributes.updated Number Last updated time in UTC.
AzureKeyVault.Key.attributes.recoveryLevel String Reflects the deletion recovery level currently in effect for keys in the current vault. If it contains ‘Purgeable’ the key can be permanently deleted by a privileged user; otherwise, only the system can purge the key, at the end of the retention interval.

Command Example

!azure-key-vault-key-delete key_name=test-key-10 vault_name=xsoar-test-vault

Context Example

{
    "AzureKeyVault": {
        "Key": {
            "attributes": {
                "created": "2021-08-18T07:07:18",
                "enabled": true,
                "exp": "2023-08-18T07:07:03",
                "nbf": "2021-08-18T07:07:03",
                "recoverableDays": 90,
                "recoveryLevel": "Recoverable+Purgeable",
                "updated": "2021-08-18T07:07:18"
            },
            "deletedDate": "2021-11-01T12:52:40",
            "key": {
                "e": "AQAB",
                "key_ops": [
                    "sign",
                    "verify",
                    "wrapKey",
                    "unwrapKey",
                    "encrypt",
                    "decrypt"
                ],
                "kid": "https://xsoar-test-vault.vault.azure.net/keys/test-key-10/KEY_VERSION",
                "kty": "RSA",
                "n": "XXX-XXXX-XXX"
            },
            "key_vault_name": "xsoar-test-vault",
            "recoveryId": "https://xsoar-test-vault.vault.azure.net/deletedkeys/test-key-10",
            "scheduledPurgeDate": "2022-01-30T12:52:40",
            "tags": {}
        }
    }
}

Human Readable Output

Delete test-key-10

Key Id Recovery Id Deleted Date Scheduled Purge Date
https://xsoar-test-vault.vault.azure.net/keys/test-key-10/KEY_VERSION https://xsoar-test-vault.vault.azure.net/deletedkeys/test-key-10 2021-11-01T12:52:40 2022-01-30T12:52:40

azure-key-vault-secret-get

Get a specified secret from a given key vault. The GET operation is applicable to any secret stored in Azure Key Vault. This operation requires the secrets/get permission.

Base Command

azure-key-vault-secret-get

Input

Argument Name Description Required
vault_name The name of the Key Vault where the secret resides in. Required
secret_name Secret name. Required
secret_version Secret version.If not specified, the latest version of the secret is returned. Optional

Context Output

Path Type Description
AzureKeyVault.Secret.value String Secret value.
AzureKeyVault.Secret.id String Secret ID.
AzureKeyVault.Secret.attributes.enabled Boolean Determines whether the object is enabled.
AzureKeyVault.Secret.attributes.created Date Creation time in UTC.
AzureKeyVault.Secret.attributes.updated Date Last updated time in UTC.
AzureKeyVault.Secret.attributes.recoveryLevel String Reflects the deletion recovery level currently in effect for secrets in the current vault. If it contains ‘Purgeable’, the secret can be permanently deleted by a privileged user; otherwise, only the system can purge the secret, at the end of the retention interval.

Command Example

!azure-key-vault-secret-get secret_name=test-sec-1 vault_name=xsoar-test-vault

Context Example

{
    "AzureKeyVault": {
        "Secret": {
            "attributes": {
                "created": "2021-08-11T12:04:12",
                "enabled": true,
                "exp": "2023-08-11T12:04:06",
                "nbf": "2021-08-11T12:04:06",
                "recoverableDays": 90,
                "recoveryLevel": "Recoverable+Purgeable",
                "updated": "2021-08-17T16:22:57"
            },
            "contentType": "text",
            "id": "https://xsoar-test-vault.vault.azure.net/secrets/test-sec-1/SECRET_VERSION",
            "key_vault_name": "xsoar-test-vault",
            "tags": {},
            "value": "test"
        }
    }
}

Human Readable Output

test-sec-1 Information

Secret Id Enabled Create Time Update Time Expiry Time
https://xsoar-test-vault.vault.azure.net/secrets/test-sec-1/SECRET_VERSION true 2021-08-11T12:04:12 2021-08-17T16:22:57 2023-08-11T12:04:06

azure-key-vault-secret-list

List secrets in a specified key vault. For a limit greater than 25, more than one API call will be required and the command might take longer time. This operation requires the secrets/list permission.

Base Command

azure-key-vault-secret-list

Input

Argument Name Description Required
vault_name The name of the Key Vault where the secrets reside in. Required
limit Limit on the number of secrets to return. Default value is 50. Optional
offset First index to retrieve from. Default value is 0. Optional

Context Output

Path Type Description
AzureKeyVault.Secret.id String Secret ID.
AzureKeyVault.Secret.attributes.enabled Boolean Determines whether the object is enabled.
AzureKeyVault.Secret.attributes.nbf Date Not before date in UTC.
AzureKeyVault.Secret.attributes.exp Date Expiry date in UTC.
AzureKeyVault.Secret.attributes.created Date Creation time in UTC.
AzureKeyVault.Secret.attributes.updated Date Last updated time in UTC.
AzureKeyVault.Secret.attributes.recoveryLevel String Reflects the deletion recovery level currently in effect for secrets in the current vault. If it contains ‘Purgeable’, the secret can be permanently deleted by a privileged user; otherwise, only the system can purge the secret, at the end of the retention interval.
AzureKeyVault.Secret.attributes.recoverableDays Number Soft Delete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0.

Command Example

!azure-key-vault-secret-list vault_name=xsoar-test-vault limit=1

Context Example

{
    "AzureKeyVault": {
        "Secret": {
            "attributes": {
                "created": "2021-08-11T12:05:48",
                "enabled": false,
                "exp": "2022-08-11T12:05:48",
                "nbf": "2021-08-11T11:55:48",
                "recoverableDays": 90,
                "recoveryLevel": "Recoverable+Purgeable",
                "updated": "2021-09-05T14:02:13"
            },
            "contentType": "application/x-pkcs12",
            "id": "https://xsoar-test-vault.vault.azure.net/secrets/test-cer-1",
            "key_vault_name": "xsoar-test-vault",
            "managed": true,
            "tags": {}
        }
    }
}

Human Readable Output

xsoar-test-vault Secrets List

Secret Id Enabled Create Time Update Time Expiry Time
https://xsoar-test-vault.vault.azure.net/secrets/test-cer-1 false 2021-08-11T12:05:48 2021-09-05T14:02:13 2022-08-11T12:05:48

azure-key-vault-secret-delete

Delete a secret from a specified key vault. This operation requires the secrets/delete permission.

Base Command

azure-key-vault-secret-delete

Input

Argument Name Description Required
vault_name The name of the Key Vault where the secret resides in. Required
secret_name Secret name to delete. Required

Context Output

Path Type Description
AzureKeyVault.Secret.recoveryId String The URL of the recovery object, used to identify and recover the deleted secret.
AzureKeyVault.Secret.deletedDate Date The time when the secret was deleted, in UTC.
AzureKeyVault.Secret.scheduledPurgeDate Date The time when the secret is scheduled to be purged, in UTC.
AzureKeyVault.Secret.id String Deleted secret ID.
AzureKeyVault.Secret.attributes.enabled Boolean Determines whether the object is enabled.
AzureKeyVault.Secret.attributes.created Date Creation time in UTC.
AzureKeyVault.Secret.attributes.updated Date Last updated time in UTC.
AzureKeyVault.Secret.attributes.recoveryLevel String Reflects the deletion recovery level currently in effect for secrets in the current vault.

Command Example

!azure-key-vault-secret-delete secret_name=test-sec-10 vault_name=xsoar-test-vault

Context Example

{
    "AzureKeyVault": {
        "Secret": {
            "attributes": {
                "created": "2021-08-18T07:08:10",
                "enabled": true,
                "recoverableDays": 90,
                "recoveryLevel": "Recoverable+Purgeable",
                "updated": "2021-08-18T07:08:10"
            },
            "contentType": "aa",
            "deletedDate": "2021-11-01T12:52:54",
            "id": "https://xsoar-test-vault.vault.azure.net/secrets/test-sec-10/SECRET_VERSION",
            "key_vault_name": "xsoar-test-vault",
            "recoveryId": "https://xsoar-test-vault.vault.azure.net/deletedsecrets/test-sec-10",
            "scheduledPurgeDate": "2022-01-30T12:52:54",
            "tags": {}
        }
    }
}

Human Readable Output

Delete test-sec-10

Secret Id Recovery Id Deleted Date Scheduled Purge Date
https://xsoar-test-vault.vault.azure.net/secrets/test-sec-10/SECRET_VERSION https://xsoar-test-vault.vault.azure.net/deletedsecrets/test-sec-10 2021-11-01T12:52:54 2022-01-30T12:52:54

azure-key-vault-certificate-get

Gets information about a specific certificate. This operation requires the certificates/get permission.

Base Command

azure-key-vault-certificate-get

Input

Argument Name Description Required
vault_name The name of the Key Vault where the certificate resides in. Required
certificate_name Certificate name. Required
certificate_version The version of the certificate. If not specified, the latest version of the certificate is returned. Optional

Context Output

Path Type Description
AzureKeyVault.Certificate.id String Certificate ID.
AzureKeyVault.Certificate.kid String Key ID.
AzureKeyVault.Certificate.sid String Secret ID.
AzureKeyVault.Certificate.x5t String Thumbprint of the certificate.
AzureKeyVault.Certificate.cer String CER contents of x509 certificate.
AzureKeyVault.Certificate.attributes.enabled Boolean Determines whether the object is enabled.
AzureKeyVault.Certificate.attributes.exp Date Expiry date in UTC.
AzureKeyVault.Certificate.attributes.created Date Creation time in UTC.
AzureKeyVault.Certificate.attributes.updated Date Last updated time in UTC.
AzureKeyVault.Certificate.attributes.recoveryLevel String Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains ‘Purgeable’, the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval.
AzureKeyVault.Certificate.policy Unknown The management policy.

Command Example

!azure-key-vault-certificate-get certificate_name=test-cer-1 vault_name=xsoar-test-vault

Context Example

{
    "AzureKeyVault": {
        "Certificate": {
            "attributes": {
                "created": "2021-08-11T12:05:48",
                "enabled": false,
                "exp": "2022-08-11T12:05:48",
                "nbf": "2021-08-11T11:55:48",
                "recoverableDays": 90,
                "recoveryLevel": "Recoverable+Purgeable",
                "updated": "2021-09-05T14:02:13"
            },
            "cer": "XXXXX-XXXXXX",
            "id": "https://xsoar-test-vault.vault.azure.net/certificates/test-cer-1/CERTIFICATE_VERSION",
            "key_vault_name": "xsoar-test-vault",
            "kid": "https://xsoar-test-vault.vault.azure.net/keys/test-cer-1/CERTIFICATE_VERSION",
            "pending": {
                "id": "https://xsoar-test-vault.vault.azure.net/certificates/test-cer-1/pending"
            },
            "policy": {
                "attributes": {
                    "created": "2021-08-11T12:05:31",
                    "enabled": true,
                    "updated": "2021-08-11T12:05:31"
                },
                "id": "https://xsoar-test-vault.vault.azure.net/certificates/test-cer-1/policy",
                "issuer": {
                    "name": "Self"
                },
                "key_props": {
                    "exportable": true,
                    "key_size": 2048,
                    "kty": "RSA",
                    "reuse_key": false
                },
                "lifetime_actions": [
                    {
                        "action": {
                            "action_type": "AutoRenew"
                        },
                        "trigger": {
                            "lifetime_percentage": 80
                        }
                    }
                ],
                "secret_props": {
                    "contentType": "application/x-pkcs12"
                },
                "x509_props": {
                    "basic_constraints": {
                        "ca": false
                    },
                    "ekus": [
                        "1.3.6.1.5.5.7.3.1",
                        "1.3.6.1.5.5.7.3.2"
                    ],
                    "key_usage": [
                        "digitalSignature",
                        "keyEncipherment"
                    ],
                    "sans": {
                        "dns_names": []
                    },
                    "subject": "CN=test",
                    "validity_months": 12
                }
            },
            "sid": "https://xsoar-test-vault.vault.azure.net/secrets/test-cer-1/CERTIFICATE_VERSION",
            "tags": {},
            "x5t": "XXXX-XXXXX"
        }
    }
}

Human Readable Output

test-cer-1 Information

Certificate Id Enabled Create Time Update Time Expiry Time
https://xsoar-test-vault.vault.azure.net/certificates/test-cer-1/CERTIFICATE_VERSION false 2021-08-11T12:05:48 2021-09-05T14:02:13 2022-08-11T12:05:48

azure-key-vault-certificate-list

List certificates in a specified key vault. For a limit greater than 25, more than one API call will be required and the command might take longer time. This operation requires the certificates/list permission.

Base Command

azure-key-vault-certificate-list

Input

Argument Name Description Required
vault_name The name of the Key Vault where the certificate reside in. Required
limit Limit on the number of certificates to return. Default value is 50. Optional
offset First index to retrieve from. Default value is 0. Optional

Context Output

Path Type Description
AzureKeyVault.Certificate.id String Certificate ID.
AzureKeyVault.Certificate.x5t String Thumbprint of the certificate.
AzureKeyVault.Certificate.attributes.enabled Boolean Determines whether the object is enabled.
AzureKeyVault.Certificate.attributes.created Date Creation time in UTC.
AzureKeyVault.Certificate.attributes.updated Date Last updated time in UTC.

Command Example

!azure-key-vault-certificate-list vault_name=xsoar-test-vault limit=1

Context Example

{
    "AzureKeyVault": {
        "Certificate": {
            "attributes": {
                "created": "2021-08-11T12:05:48",
                "enabled": false,
                "exp": "2022-08-11T12:05:48",
                "nbf": "2021-08-11T11:55:48",
                "updated": "2021-09-05T14:02:13"
            },
            "id": "https://xsoar-test-vault.vault.azure.net/certificates/test-cer-1",
            "key_vault_name": "xsoar-test-vault",
            "subject": "",
            "tags": {},
            "x5t": "XXXX-XXXXX"
        }
    }
}

Human Readable Output

xsoar-test-vault Certificates List

Certificate Id Enabled Create Time Update Time Expiry Time
https://xsoar-test-vault.vault.azure.net/certificates/test-cer-1 false 2021-08-11T12:05:48 2021-09-05T14:02:13 2022-08-11T12:05:48

azure-key-vault-certificate-policy-get

Get the policy of the specified certificate.This operation requires the certificates/get permission.

Base Command

azure-key-vault-certificate-policy-get

Input

Argument Name Description Required
vault_name The name of the Key Vault where the secret resides in. Required
certificate_name The name of the certificate to retrieve the policy from. Required

Context Output

Path Type Description
AzureKeyVault.CertificatePolicy.id String Policy ID.
AzureKeyVault.CertificatePolicy.key_props Unknown Properties of the key backing a certificate.
AzureKeyVault.CertificatePolicy.x509_props Unknown Properties of the X509 component of a certificate.
AzureKeyVault.CertificatePolicy.lifetime_actions Unknown Actions that will be performed by Key Vault over the lifetime of a certificate.
AzureKeyVault.CertificatePolicy.issuer Unknown Parameters for the issuer of the X509 component of a certificate.
AzureKeyVault.CertificatePolicy.attributes.enabled Boolean Determines whether the object is enabled.
AzureKeyVault.CertificatePolicy.attributes.created Date Creation time in UTC.
AzureKeyVault.CertificatePolicy.attributes.updated Date Last updated time in UTC.

Command Example

!azure-key-vault-certificate-policy-get certificate_name=test-cer-1 vault_name=xsoar-test-vault

Context Example

{
    "AzureKeyVault": {
        "CertificatePolicy": {
            "CertificateName": "test-cer-1",
            "attributes": {
                "created": "2021-08-11T12:05:31",
                "enabled": true,
                "updated": "2021-08-11T12:05:31"
            },
            "id": "https://xsoar-test-vault.vault.azure.net/certificates/test-cer-1/policy",
            "issuer": {
                "name": "Self"
            },
            "key_props": {
                "exportable": true,
                "key_size": 2048,
                "kty": "RSA",
                "reuse_key": false
            },
            "lifetime_actions": [
                {
                    "action": {
                        "action_type": "AutoRenew"
                    },
                    "trigger": {
                        "lifetime_percentage": 80
                    }
                }
            ],
            "secret_props": {
                "contentType": "application/x-pkcs12"
            },
            "x509_props": {
                "basic_constraints": {
                    "ca": false
                },
                "ekus": [
                    "1.3.6.1.5.5.7.3.1",
                    "1.3.6.1.5.5.7.3.2"
                ],
                "key_usage": [
                    "digitalSignature",
                    "keyEncipherment"
                ],
                "sans": {
                    "dns_names": []
                },
                "subject": "CN=test",
                "validity_months": 12
            }
        }
    }
}

Human Readable Output

test-cer-1 Policy Information

Id Key Props Secret Props X509 Props Issuer Attributes
https://xsoar-test-vault.vault.azure.net/certificates/test-cer-1/policy exportable: true
kty: RSA
key_size: 2048
reuse_key: false		 contentType: application/x-pkcs12 subject: CN=test
sans: {“dns_names”: []}
ekus: 1.3.6.1.5.5.7.3.1,
1.3.6.1.5.5.7.3.2
key_usage: digitalSignature,
keyEncipherment
validity_months: 12
basic_constraints: {“ca”: false}		 name: Self enabled: true
created: 2021-08-11T12:05:31
updated: 2021-08-11T12:05:31

azure-key-vault-subscriptions-list

List all subscriptions for a tenant.

Base Command

azure-key-vault-subscriptions-list

Input

There are no input arguments for this command.

Context Output

Path Type Description
AzureKeyVault.Subscription.id String Subscription ID.
AzureKeyVault.Subscription.displayName String Subscription display name.
AzureKeyVault.Subscription.state String Subscription state.
AzureKeyVault.Subscription.subscriptionPolicies Unknown Subscription policies.
AzureKeyVault.Subscription.authorizationSource String Authorization source.
AzureKeyVault.Subscription.managedByTenants Unknown Managed by tenants.
AzureKeyVault.Subscription.tenantId String Tenant ID.

azure-key-vault-resource-group-list

List all resource groups for a subscription.

Base Command

azure-key-vault-resource-group-list

Input

Argument Name Description Required
subscription_id The subscription ID. Note: This argument will override the instance parameter ‘Subscription ID’. Optional
limit Limit on the number of resource groups to return. Default is 50. Default is 50. Optional
tag A single tag in the form of ‘{“Tag Name”:”Tag Value”}’ to filter the list by. Optional

Context Output

Path Type Description
AzureKeyVault.ResourceGroup.id String Resource group ID.
AzureKeyVault.ResourceGroup.name String Resource group name.
AzureKeyVault.ResourceGroup.location String Resource group location.
AzureKeyVault.ResourceGroup.tags Unknown Resource group tags.
AzureKeyVault.ResourceGroup.properties.provisioningState unknown Resource group provisioning state.

azure-key-vault-auth-reset

Run this command if for some reason you need to rerun the authentication process.

Base Command

azure-key-vault-auth-reset

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Configuration parameters

  • azure_cloud — Azure Cloud
  • client_id — Client ID
  • credentials —
  • tenant_id — Tenant ID (required)
  • certificate_thumbprint — Certificate Thumbprint
  • credentials_certificate_thumbprint —
  • private_key — Private Key
  • use_managed_identities — Use Azure Managed Identities
  • managed_identities_client_id —
  • subscription_id — Default Subscription ID (required)
  • resource_group_name — Default Resource Group Name (required)
  • isFetchCredentials — Fetches credentials
  • credentials_fetch_mode — Credentials Fetch Mode
  • key_vaults — Key Vault names - a comma separated list of Key Vaults to fetch secrets from.
  • secrets — Secret names - a comma separated list of secrets to fetch.
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (17)

  • azure-key-vault-access-policy-update

    Update access policies in a key vault in the specified subscription. The update regards only the access policy for the specified object ID.

  • azure-key-vault-auth-reset

    Run this command if for some reason you need to rerun the authentication process.

  • azure-key-vault-certificate-get

    Gets information about a specific certificate. This operation requires the certificates/get permission.

  • azure-key-vault-certificate-list

    List certificates in a specified key vault. For a limit greater than 25, more than one API call will be required and the command might take longer time. This operation requires the certificates/list permission.

  • azure-key-vault-certificate-policy-get

    Get the policy of the specified certificate.This operation requires the certificates/get permission.

  • azure-key-vault-create-update

    Create or update a key vault in the specified subscription. If the Key Vault exists, the updated properties will overwrite the existing ones. Please use azure-key-vault-access-policy-update command if you wish to update the access policy of an existing Key Vault.

  • azure-key-vault-delete

    Delete the specified key vault.

  • azure-key-vault-get

    Get the specified key vault.

  • azure-key-vault-key-delete

    Delete a key of any type from storage in Azure Key vault. This operation requires the keys/delete permission.

  • azure-key-vault-key-get

    Get the public part of a stored key. This operation requires the keys/get permission.

  • azure-key-vault-key-list

    List keys in the specified vault. For a limit greater than 25, more than one API call will be required and the command might take longer time. This operation requires the keys/list permission.

  • azure-key-vault-list

    The List operation gets information about the vaults associated with the subscription. For a limit greater than 25, more than one API call will be required and the command might take longer time.

  • azure-key-vault-resource-group-list

    List all resource groups for a subscription.

  • azure-key-vault-secret-delete

    Delete a secret from a specified key vault. This operation requires the secrets/delete permission.

  • azure-key-vault-secret-get

    Get a specified secret from a given key vault. The GET operation is applicable to any secret stored in Azure Key Vault. This operation requires the secrets/get permission.

  • azure-key-vault-secret-list

    List secrets in a specified key vault. For a limit greater than 25, more than one API call will be required and the command might take longer time. This operation requires the secrets/list permission.

  • azure-key-vault-subscriptions-list

    List all subscriptions for a tenant.

Source

AzureKeyVault.py AzureKeyVault_test.py AzureKeyVault.yml AzureKeyVault_description.md
Download History Raw 

### Authorize Cortex XSOAR for Azure Key Vault 

#### Self-Deployed Authentication
Follow these steps for a self-deployed configuration:

1. To use a self-configured Azure application, add a new Azure App Registration in the Azure Portal. To add the registration, see the [Azure app registration article](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app).


2. Make sure the following permissions are granted for the app registration:  
   - Azure Service Management - permission user_impersonation of type Delegated
   - Azure Key Vault - permission user_impersonation of type Delegated


#### Get client ID and tenant ID values 

1. In the Azure portal, select Entra ID.
2. From App registrations in Azure AD, select your application.
3. Copy the Directory (tenant) ID and enter it in the Tenant ID parameter.
4. Copy the Application ID and store it in the Client ID parameter.
   
#### Get client secret value

1. In the Azure portal, select Entra ID.
2. From App registrations in Azure AD, select your application.
3. Select Certificates & secrets.
4. Select Client secrets -> New client secret.
5. Provide a description of the secret, and a duration. When done, select Add.
6. After saving the client secret, the value of the client secret is displayed. 
7. Copy this value and enter it in the Client Secret parameter.

#### Azure Managed Identities Authentication
##### Note: This option is relevant only if the integration is running on Azure VM.
Follow one of these steps for authentication based on Azure Managed Identities:

- ##### To use System Assigned Managed Identity
   - Select the **Use Azure Managed Identities** checkbox and leave the **Azure Managed Identities Client ID** field empty.

- ##### To use User Assigned Managed Identity
   1. Go to the [Azure Portal](https://portal.azure.com/) -> **Managed Identities**
   2. Select your User Assigned Managed Identity -> copy the Client ID -> paste it in the **Azure Managed Identities Client ID** field in the instance settings.
   3. Select the **Use Azure Managed Identities** checkbox.

For more information, see [Managed identities for Azure resources](https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview).


### Get Subscription ID and the Resource Group values

1. In the Azure portal, select Resource groups.
2. Select your resource group name.
3. Copy the Subscription ID and enter it in the Subscription ID parameter.
4. Copy your resource group name and enter it in the Resource Group Name parameter.


 ### Fetch credentials from Azure Key Vault
In order to fetch credentials to the Cortex XSOAR credentials store,you should follow the next steps:
1. Check Fetches credentials parameter.
2. Fill Key Vault names to fetch secrets from.
3. Fill secret names to fetch.

After the Azure Key Vault integration instance is created, the credentials will be fetched
to the Cortex XSOAR credentials store in the following format:

Credential Name: KEY_VAULT_NAME/SECRET_NAME

Username: SECRET_NAME

Password: SECRET_VALUE

### Credentials Fetch Mode
Set **Credentials Fetch Mode** to **External Credentials Vault (on-demand)** if your security policy does not allow secrets to be stored inside the Cortex credentials store. In this mode, the credentials picker in other integrations will list the configured secrets by name (KEY_VAULT_NAME/SECRET_NAME), but no secret values are pulled from Azure Key Vault. When a playbook or command actually executes an integration that uses one of those credentials, the secret value is fetched live from Azure Key Vault and is passed in memory only. Nothing is persisted in Cortex.

The default mode **Store in Cortex** keeps the existing behavior: The secret values are fetched and stored in the Cortex credentials store.