Azure Security Center Deprecated

Deprecated. Unified security management and advanced threat protection across hybrid cloud workloads.

Analytics & SIEM · Deprecated Content (Deprecated)

Details

ID	`Azure Security Center`
Provider	Microsoft
Category	Analytics & SIEM
From Version	5.0.0
Docker Image	`demisto/python:2.7.18.20958`

Configuration parameters

server_url — Microsoft Azure Management URL
tenant_id — Tenant ID (received from the admin consent - see Detailed Instructions (?) section) (required)
token — Token (received from the admin consent - see detailed instructions (?)) (required)
unsecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (8)

azure-sc-get-aps Deprecated
Returns details of a specific auto provisioning setting.
azure-sc-get-atp Deprecated
Returns the Advanced Threat Protection setting.
azure-sc-list-alert Deprecated
Lists alerts for the subscription according to the specified filters.
azure-sc-list-aps Deprecated
Lists auto provisioning settings in the subscription.
azure-sc-list-jit Deprecated
Lists all policies for protecting resources using Just-in-Time access control.
azure-sc-list-storage Deprecated
Lists all the storage accounts available under the subscription.
azure-sc-update-aps Deprecated
Updates a specific auto provisioning setting.
azure-sc-update-atp Deprecated
Updates Advanced Threat Detection settings.

Source

AzureSecurityCenter.py AzureSecurityCenter.yml AzureSecurityCenter_description.md

Download History Raw

category: Analytics & SIEM
provider: Microsoft
commonfields:
  id: Azure Security Center
  version: -1
configuration:
- defaultvalue: https://management.azure.com
  display: Microsoft Azure Management URL
  name: server_url
  type: 0
  required: false
- display: Tenant ID (received from the admin consent - see Detailed Instructions (?) section)
  name: tenant_id
  required: true
  type: 4
- display: Token (received from the admin consent - see detailed instructions (?))
  name: token
  required: true
  type: 4
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: Deprecated. Unified security management and advanced threat protection across hybrid cloud workloads.
display: Azure Security Center (Deprecated)
name: Azure Security Center
script:
  commands:
  - arguments:
    - description: The name of the resource group within the user's subscription. The name is case insensitive.
      name: resource_group_name
    - description: The location where Azure Security Center stores the data of the subscription. Run the 'azure-sc-location-list' command to get the ascLocation. This command requires the resourceGroupName argument.
      name: asc_location
    - description: OData filter
      name: filter
    - description: OData select
      name: select
    - description: OData expand
      name: expand
    deprecated: true
    description: Lists alerts for the subscription according to the specified filters.
    name: azure-sc-list-alert
    outputs:
    - contextPath: AzureSecurityCenter.Alert.AlertDisplayName
      description: Alert display name
      type: string
    - contextPath: AzureSecurityCenter.Alert.CompromisedEntity
      description: The entity on which the incident occurred
      type: string
    - contextPath: AzureSecurityCenter.Alert.DetectedTimeUtc
      description: Time the vendor detected the incident
      type: date
    - contextPath: AzureSecurityCenter.Alert.ReportedSeverity
      description: Estimated severity of this alert
      type: string
    - contextPath: AzureSecurityCenter.Alert.State
      description: Alert state (Active, Dismissed, etc.)
      type: string
    - contextPath: AzureSecurityCenter.Alert.ID
      description: Alert ID
      type: string
  - arguments:
    - description: Resource group name
      name: resource_group_name
      required: true
    - default: true
      defaultValue: current
      description: Name of the Advanced Threat Detection setting, default is 'current'.
      name: setting_name
    - description: Storage name in your Azure account
      name: storage_account
      required: true
    - description: Indicates whether Advanced Threat Protection is enabled.
      name: is_enabled
      required: true
    deprecated: true
    description: Updates Advanced Threat Detection settings.
    name: azure-sc-update-atp
    outputs:
    - contextPath: AzureSecurityCenter.AdvancedThreatProtection.ID
      description: Resource ID
      type: string
    - contextPath: AzureSecurityCenter.AdvancedThreatProtection.Name
      description: Resource Name
      type: string
    - contextPath: AzureSecurityCenter.AdvancedThreatProtection.IsEnabled
      description: Indicates whether Advanced Threat Protection is enabled
      type: string
  - arguments:
    - description: Name of the resource group.
      name: resource_group_name
      required: true
    - defaultValue: current
      description: Name of Advanced Threat Detection setting, default setting's name is 'current'.
      name: setting_name
    - description: Name of a storage in your azure account.
      name: storage_account
      required: true
    deprecated: true
    description: Returns the Advanced Threat Protection setting.
    name: azure-sc-get-atp
    outputs:
    - contextPath: AzureSecurityCenter.AdvancedThreatProtection.ID
      description: Resource ID
      type: string
    - contextPath: AzureSecurityCenter.AdvancedThreatProtection.Name
      description: Resource name
      type: string
    - contextPath: AzureSecurityCenter.AdvancedThreatProtection.IsEnabled
      description: Indicates whether Advanced Threat Protection is enabled
      type: string
  - arguments:
    - default: true
      defaultValue: default
      description: Name of the auto provisioning setting, default setting's name is 'default'
      name: setting_name
      required: true
    - description: Describes the type of security agent provisioning action to take (On or Off)
      name: auto_provision
      required: true
    deprecated: true
    description: Updates a specific auto provisioning setting.
    name: azure-sc-update-aps
    outputs:
    - contextPath: AzureSecurityCenter.AutoProvisioningSetting.Name
      description: Setting display name
      type: string
    - contextPath: AzureSecurityCenter.AutoProvisioningSetting.AutoProvision
      description: Display the type of security agent provisioning action to take (On or Off)
      type: string
    - contextPath: AzureSecurityCenter.AutoProvisioningSetting.ID
      description: Setting resource ID
      type: string
  - arguments:
    - defaultValue: default
      description: Name of the auto provisioning setting
      name: setting_name
      required: true
    deprecated: true
    description: Returns details of a specific auto provisioning setting.
    name: azure-sc-get-aps
    outputs:
    - contextPath: AzureSecurityCenter.AutoProvisioningSetting.Name
      description: Setting display name
      type: string
    - contextPath: AzureSecurityCenter.AutoProvisioningSetting.AutoProvision
      description: Display the type of security agent provisioning action to take (On or Off)
      type: string
    - contextPath: AzureSecurityCenter.AutoProvisioningSetting.ID
      description: Set resource ID
      type: string
  - deprecated: true
    description: Lists auto provisioning settings in the subscription.
    name: azure-sc-list-aps
    outputs:
    - contextPath: AzureSecurityCenter.AutoProvisioningSetting.Name
      description: Setting display name
      type: string
    - contextPath: AzureSecurityCenter.AutoProvisioningSetting.AutoProvision
      description: Display the type of security agent provisioning action to take (On or Off)
      type: string
    - contextPath: AzureSecurityCenter.AutoProvisioningSetting.ID
      description: Setting resource ID
      type: string
  - arguments:
    - description: The location where Azure Security Center stores the data of the subscription. Run the 'azure-sc-list-location' command to get the asc_location.
      name: asc_location
    - description: The name of the resource group within the user's subscription. The name is case insensitive.
      name: resource_group_name
    deprecated: true
    description: Lists all policies for protecting resources using Just-in-Time access control.
    name: azure-sc-list-jit
    outputs:
    - contextPath: AzureSecurityCenter.JITPolicy.Name
      description: Poliyc display name
      type: string
    - contextPath: AzureSecurityCenter.JITPolicy.Rules
      description: 'CSV list of access rules for Microsoft.Compute/virtualMachines resource, in the format (VMName: allowPort1,...)'
      type: string
    - contextPath: AzureSecurityCenter.JITPolicy.Location
      description: Location where the resource is stored
      type: string
    - contextPath: AzureSecurityCenter.JITPolicy.Kind
      description: Policy resource type
      type: string
  - deprecated: true
    description: Lists all the storage accounts available under the subscription.
    name: azure-sc-list-storage
    outputs:
    - contextPath: AzureSecurityCenter.Storage.Name
      description: Name of the storage account
      type: string
    - contextPath: AzureSecurityCenter.Storage.ResourceGroupName
      description: Names of the attached resource group
      type: string
    - contextPath: AzureSecurityCenter.Storage.Location
      description: The geo-location where the resource resides
      type: string
  runonce: false
  script: '-'
  type: python
  subtype: python2
  dockerimage: demisto/python:2.7.18.20958
tests:
- No tests
deprecated: true
fromversion: 5.0.0