Azure Resource Graph

Details

ID	`Azure Resource Graph`
Provider	Microsoft
Category	Cloud Services
From Version	6.10.0
Docker Image	`demisto/crypto:1.0.0.10120494`
Supported Modules	Agentix XSIAM Cloud Posture Security

README

Azure Resource Graph is an Azure service designed to extend Azure Resource Management by providing efficient and performant resource exploration with the ability to query at scale across a given set of resources.

Authorize Cortex XSOAR for Azure Resource Graph (Self-Deployed Configuration)

To use a self-configured Azure application, you need to add a new Azure App Registration in the Azure Portal. To add the registration, see the Microsoft article.

Authentication

To enable and configure authentication using self deployed app, follow the Self-Deployed Application Authentication

For more details about the authentication used in this integration, see Microsoft Integrations - Authentication.

After authorizing the Self-Deployed Application, you will get an ID, Token, and Key, which should be inserted in the integration instance configuration’s corresponding fields. After giving consent, the application has to have a role assigned so it can access the relevant resources per subscription.
In order to assign a role to the application after consent was given:
- Go to the Azure Portal UI.
- Go to Subscriptions, and then Access Control (IAM).
- Click “Add role assignment”.
- Create a new role or select a role that includes permissions for the queries you plan to run.
- Select the Azure Resource Graph application. By default, Azure Applications aren’t displayed in the available options. To find your application, search for the name and select it.

Client Credentials Flow

Follow these steps for client-credentials configuration:.

In the instance configuration, select the Use a self-deployed Azure application - Client Credentials Authorization Flow checkbox.
Enter your Client ID in the ID (Client ID) parameter.
Enter your Client Secret in the Key (Client Secret) parameter.
Enter your Tenant ID in the Token (Tenant ID) parameter.
Click Test to validate the URLs, token, and connection.

To use The Azure Resource Graph, you must have appropriate rights in Azure role-based access control (Azure RBAC) with at least read access to the resources you want to query. No results are returned if you don’t have at least read permissions to the Azure object or object group.

Configure Azure Resource Graph in Cortex

Parameter	Description	Required
Token / Tenant ID	Received from the authorization process or from the self-deployed configuration process (find the tenant ID in your app overview page in the Azure portal)	False
Token / Tenant ID		False
ID / Client ID	Received from the authorization process or from the self-deployed configuration process.	False
Key / Client Secret		False
Certificate Thumbprint	Used for certificate authentication. As appears in the “Certificates & secrets” page of the app.	False
Private Key	Used for certificate authentication. The private key of the registered certificate.	False
Trust any certificate (not secure)		False
Use system proxy settings		False
Gov Account	Select this checkbox if you are using a US Government cloud account (GCC-High). When enabled, the integration uses the US Government management endpoint and Azure US GCC-High cloud configuration.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

azure-rg-list-operations

Base Command

azure-rg-list-operations

Input

Argument Name	Description	Required
limit	The maximum number of operations to return (Default is 50).	Optional

Context Output

Path	Type	Description
AzureResourceGraph.Operations	String	A list of available Azure Resource Graph operations permissions and descriptions.

Command Example

!azure-rg-list-operations limit=50

Context Example

{
  "value": [
      {
          "name": "Microsoft.ResourceGraph/operations/read",
          "display": {
              "provider": "Microsoft Resource Graph",
              "resource": "Operation",
              "operation": "Get Operations",
              "description": "Gets the list of supported operations"
          }
      },
      {
          "name": "Microsoft.ResourceGraph/resources/read",
          "display": {
              "provider": "Microsoft Resource Graph",
              "resource": "Resources",
              "operation": "Query resources",
              "description": "Submits a query on resources within specified subscriptions, management groups or tenant scope"
          }
      }
  ]
}

Human Readable Output

Display	Name
provider: Microsoft Resource Graph resource: Operation operation: Get Operations description: Gets the list of supported operations	Microsoft.ResourceGraph/operations/read
provider: Microsoft Resource Graph resource: Resources operation: Query resources description: Submits a query on resources within specified subscriptions, management groups or tenant scope	Microsoft.ResourceGraph/resources/read

azure-rg-query

Base Command

azure-rg-query

Input

Argument Name	Description	Required
query	The query to execute.	Required

Context Output

Path	Type	Description
AzureResourceGraph.Query	String	Data returned from query.

Command Example

!azure-rg-query query="resources | where type == 'microsoft.network/publicipaddresses'| where properties['ipAddress'] == '11.22.33.44' | project name, id, tenantId, subscriptionId, resourceGroup | join kind=inner (resourcecontainers | where type == 'microsoft.resources/subscriptions' | project subscriptionId, properties.managementGroupAncestorsChain) on subscriptionId"

Context Example

{
    "count": 1,
    "data": [
        {
            "id": "/subscriptions/1abc234d-12a3-12a3-12a3-1234abcde123/resourceGroups/test-vm-resource-group/providers/Microsoft.Network/publicIPAddresses/test-vm-1-ip",
            "name": "test-vm-1-ip",
            "properties_managementGroupAncestorsChain": [
                {
                    "displayName": "grand-child-managment-group",
                    "name": "grand-child-managment-group"
                },
                {
                    "displayName": "child-management-group",
                    "name": "child-management-group"
                },
                {
                    "displayName": "test-new-managment-group",
                    "name": "test-new-managment-group"
                },
                {
                    "displayName": "Tenant Root Group",
                    "name": "a11111111-222-3333-12a3-1234abcde123"
                }
            ],
            "resourceGroup": "test-vm-resource-group",
            "subscriptionId": "1abc234d-12a3-12a3-12a3-1234abcde123",
            "tenantId": "a11111111-222-3333-12a3-1234abcde123"
        }
    ],
    "facets": [],
    "resultTruncated": "false",
    "totalRecords": 1
}

Human Readable Output

id	name	properties_managementGroupAncestorsChain	resourceGroup	subscriptionId	tenantId
/subscriptions/1abc234d-12a3-12a3-12a3-1234abcde123/resourceGroups/test-vm-resource-group/providers/Microsoft.Network/publicIPAddresses/test-vm-1-ip	test-vm-1-ip	{‘displayName’: ‘grand-child-managment-group’, ‘name’: ‘grand-child-managment-group’}, {‘displayName’: ‘child-management-group’, ‘name’: ‘child-management-group’}, {‘displayName’: ‘test-new-managment-group’, ‘name’: ‘test-new-managment-group’}, {‘displayName’: ‘Tenant Root Group’, ‘name’: ‘a11111111-222-3333-12a3-1234abcde123’}	test-vm-resource-group	1abc234d-12a3-12a3-12a3-1234abcde123	a11111111-222-3333-12a3-1234abcde123

azure-rg-auth-reset

Run this command if for some reason you need to rerun the authentication process.

Base Command

azure-rg-auth-reset

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Configuration parameters

host — Server URL (e.g., https://management.azure.com) (required)
cred_auth_id —
cred_token —
cred_enc_key —
cred_certificate_thumbprint —
private_key — Private Key
gov_account — Use Gov Account Settings
proxy — Use system proxy settings
unsecure — Trust any certificate (not secure)

Commands (3)

azure-rg-auth-reset
Run this command if for some reason you need to rerun the authentication process.
azure-rg-list-operations
Gets all Azure Resource Graph operations permissions and descriptions.
azure-rg-query
Executes a given Azure Resource Graph Query. (Ex: query="Resources | project name, type | limit 5 | order by name asc").

Source

AzureResourceGraph.py AzureResourceGraph_test.py AzureResourceGraph.yml AzureResourceGraph_description.md command_examples.txt

Download History Raw

category: Cloud Services
provider: Microsoft
sectionorder:
- Connect
- Collect
commonfields:
  id: Azure Resource Graph
  version: -1
configuration:
- display: Server URL (e.g., https://management.azure.com)
  name: host
  defaultvalue: https://management.azure.com
  type: 0
  required: true
  section: Connect
- displaypassword: ID / Client ID
  name: cred_auth_id
  type: 9
  required: false
  hiddenusername: true
  display: ""
  section: Connect
- displaypassword: Token / Tenant ID
  name: cred_token
  type: 9
  required: false
  hiddenusername: true
  display: ""
  section: Connect
- displaypassword: Key / Client Secret
  name: cred_enc_key
  type: 9
  required: false
  hiddenusername: true
  display: ""
  section: Connect
- display: ""
  displaypassword: Certificate Thumbprint
  name: cred_certificate_thumbprint
  type: 9
  required: false
  hiddenusername: true
  additionalinfo: Used for certificate authentication. As appears in the "Certificates & secrets" page of the app.
  section: Connect
- display: Private Key
  name: private_key
  type: 14
  additionalinfo: Used for certificate authentication. The private key of the registered certificate.
  hidden: true
  section: Connect
- display: Use Gov Account Settings
  name: gov_account
  type: 8
  required: false
  additionalinfo: Select this checkbox if you are using a US Government cloud account.
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  required: false
  section: Connect
description: 'Azure Resource Graph integration is designed to allow for executing Azure Resource Graph commands, like querying resource data.'
display: Azure Resource Graph
name: Azure Resource Graph
script:
  commands:
  - name: azure-rg-auth-reset
    arguments: []
    description: Run this command if for some reason you need to rerun the authentication process.
  - name: azure-rg-list-operations
    arguments:
    - description: 'The maximum number of operations to return. NOTE: Do not use with "page" and "page_size".'
      name: limit
    - description: The maximum number of operations to return for page.
      name: page_size
    - description: The page number to return.
      name: page
    outputs:
    - contextPath: AzureResourceGraph.Operations
      description: A list of available Azure Resource Graph operations permissions and descriptions.
      type: String
    description: Gets all Azure Resource Graph operations permissions and descriptions.
  - name: azure-rg-query
    arguments:
    - description: 'The maximum number of operations to return (Default is 50). NOTE: Do not use with "page" and "page_size".'
      name: limit
    - description: The maximum number of operations to return for page.
      name: page_size
    - description: The page number to return.
      name: page
    - name: management_groups
      description: "Azure management groups against which to execute the query. Example: 'mg1, mg2'."
      isArray: true
    - name: subscriptions
      description: "Azure subscriptions against which to execute the query. Example: 'sub1, sub2'."
      isArray: true
    - name: query
      required: true
      description: |-
        The query for the Azure Resource Graph to execute.
        For example: `resources | where (resourceGroup =~ ('demisto-sentinel2'))`. 
        The query is based on Kusto Query Language (KQL). Reference: https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/
    outputs:
    - contextPath: AzureResourceGraph.Query
      description: Data returned from query.
      type: String
    description: 'Executes a given Azure Resource Graph Query. (Ex: query="Resources | project name, type | limit 5 | order by name asc").'
  dockerimage: demisto/crypto:1.0.0.10120494
  runonce: false
  script: ''
  subtype: python3
  type: python
fromversion: 6.10.0
tests:
- No tests (auto formatted)