Azure Security Center v2

Details

ID	`Azure Security Center v2`
Provider	Microsoft
Category	Analytics & SIEM
From Version	5.0.0
Docker Image	`demisto/crypto:1.0.0.10120494`
Supported Modules	Agentix XSIAM

README

Unified security management and advanced threat protection across hybrid cloud workloads.
For more information see Azure Security Center documentation

Use Case

With Security Center, you can apply security policies across your workloads, limit your exposure to threats, and detect and respond to attacks.

Authentication

For more details about the authentication used in this integration, see Microsoft Integrations - Authentication .

After authorizing the Demisto app, you will get an ID, Token, and Key, which should be inserted in the integration instance configuration’s corresponding fields. After giving consent, the application has to have a role assigned so it can access the relevant resources per subscription.
In order to assign a role to the application after consent was given:
- Go to the Azure Portal UI.
- Go to Subscriptions, and then Access Control (IAM).
- Click Add.
- Select a role that includes the following permissions:
  - Microsoft.Security/locations/read
  - Microsoft.Security/alerts/read
  - Microsoft.Security/locations/alerts/read
  - Microsoft.Storage/storageAccounts/read
  - Microsoft.Management/managementGroups/read
  - Microsoft.Security/advancedThreatProtectionSettings/*
  - Microsoft.Security/informationProtectionPolicies/read
  - Microsoft.Security/locations/jitNetworkAccessPolicies/*
  - Microsoft.Security/locations/jitNetworkAccessPolicies/initiate/action
- Select the Azure Security Center application.

Configure Azure Security Center v2 on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for Azure Security Center v2.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Microsoft Azure Management URL
- ID (received from the admin consent - see Detailed Instructions (?)
- Token (received from the admin consent - see Detailed Instructions (?) section)
- Key (received from the admin consent - see Detailed Instructions (?)
- Trust any certificate (not secure)
- Use system proxy settings
- Default subscription ID to use
Click Test to validate the new instance.

Commands

Subscription ID

Some commands require a subscription ID parameter in order to run.
You can find your organization’s subscriptions list in the Microsoft Azure Portal > Subscriptions or by running the azure-list-subscriptions command.

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

azure-sc-list-alert
azure-sc-update-atp
azure-sc-get-atp
azure-sc-update-aps
azure-sc-get-aps
azure-sc-list-aps
azure-sc-list-jit
azure-sc-list-storage
azure-list-subscriptions
azure-sc-list-location
azure-sc-get-alert
azure-get-secure-score

1. azure-sc-list-alert

Lists alerts for the subscription according to the specified filters.
The OData select, expand, and filter arguments are deprecated, as they are no longer supported by Microsoft Defender for Cloud and have no effect.

Require Subscription ID

Base Command

azure-sc-list-alert

Input

Argument Name	Description	Required
resource_group_name	The name of the resource group within the user’s subscription. The name is case insensitive.	Optional
asc_location	The location where Azure Security Center stores the data of the subscription. Run the ‘azure-sc-list-location’ command to get the ascLocation. This command requires the resourceGroupName argument.	Optional
subscription_id	Subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscripton ID will be used.	Optional

Context Output

Path	Type	Description
AzureSecurityCenter.Alert.DisplayName	string	The display name of the alert.
AzureSecurityCenter.Alert.CompromisedEntity	string	The entity on which the incident occurred.
AzureSecurityCenter.Alert.Description	string	Description of the suspicious activity that was detected.
AzureSecurityCenter.Alert.DetectedTime	date	The time the vendor detected the incident.
AzureSecurityCenter.Alert.ReportedSeverity	string	The estimated severity of this alert.
AzureSecurityCenter.Alert.State	string	The alert state (Active, Dismissed, etc.).
AzureSecurityCenter.Alert.ID	string	The alert ID.

Command Example

!azure-sc-list-alert

Context Example

{
    "AzureSecurityCenter.Alert": [
        {
            "CompromisedEntity": "alerts",
            "Description": "Azure security center has detected incoming traffic from IP addresses, which have been identified as IP addresses that should be blocked by the Adaptive Network Hardening control",
            "DetectedTime": "2019-10-27T00:00:00Z",
            "DisplayName": "Traffic from unrecommended IP addresses was detected",
            "ID": "2518301663999999999_d1521d81-f4c1-40ae-b224-01456637790c",
            "ReportedSeverity": "Information",
            "State": "Active"
        }
    ]
}

Human Readable Output

Azure Security Center - List Alerts

DisplayName	CompromisedEntity	DetectedTime	ReportedSeverity	State	Description	ID
Traffic from unrecommended IP addresses was detected	alerts	2019-10-27T00:00:00Z	Information	Active	Azure security center has detected incoming traffic from IP addresses, which have been identified as IP addresses that should be blocked by the Adaptive Network Hardening control	2518301663999999999_d1521d81-f4c1-40ae-b224-01456637790c

2. azure-sc-update-atp

Updates Advanced Threat Detection settings.

Require Subscription ID

Base Command

azure-sc-update-atp

Input

Argument Name	Description	Required
resource_group_name	Resource group name	Required
setting_name	Name of the Advanced Threat Detection setting, default is ‘current’.	Optional
storage_account	Storage name in your Azure account	Required
is_enabled	Indicates whether Advanced Threat Protection is enabled.	Required
subscription_id	Subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscripton ID will be used.	Optional

Context Output

Path	Type	Description
AzureSecurityCenter.AdvancedThreatProtection.ID	string	Resource ID
AzureSecurityCenter.AdvancedThreatProtection.Name	string	Resource Name
AzureSecurityCenter.AdvancedThreatProtection.IsEnabled	string	Indicates whether Advanced Threat Protection is enabled

Command Example

!azure-sc-update-atp resource_group_name=recouce_name

3. azure-sc-get-atp

Returns the Advanced Threat Protection setting.

Require Subscription ID

Base Command

azure-sc-get-atp

Input

Argument Name	Description	Required
resource_group_name	Name of the resource group.	Required
setting_name	Name of Advanced Threat Detection setting, default setting’s name is ‘current’.	Optional
storage_account	Name of a storage in your azure account.	Required
subscription_id	Subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscripton ID will be used.	Optional

Context Output

Path	Type	Description
AzureSecurityCenter.AdvancedThreatProtection.ID	string	Resource ID
AzureSecurityCenter.AdvancedThreatProtection.Name	string	Resource name
AzureSecurityCenter.AdvancedThreatProtection.IsEnabled	string	Indicates whether Advanced Threat Protection is enabled

Command Example

!azure-sc-get-atp resource_group_name=resource_group storage_account=st_acc1

4. azure-sc-update-aps

Updates a specific auto provisioning setting.

Require Subscription ID

Base Command

azure-sc-update-aps

Input

Argument Name	Description	Required
setting_name	Name of the auto provisioning setting, default setting’s name is ‘default’	Required
auto_provision	Describes the type of security agent provisioning action to take (On or Off)	Required
subscription_id	Subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscripton ID will be used.	Optional

Context Output

Path	Type	Description
AzureSecurityCenter.AutoProvisioningSetting.Name	string	Setting display name
AzureSecurityCenter.AutoProvisioningSetting.AutoProvision	string	Display the type of security agent provisioning action to take (On or Off)
AzureSecurityCenter.AutoProvisioningSetting.ID	string	Setting resource ID

Command Example

!azure-sc-update-aps setting_name=default auto_provision=Off

Context Example

{
    "AzureSecurityCenter.AutoProvisioningSetting": [
        {
            "AutoProvision": null,
            "ID": "/subscriptions/xxxx-xxxx-xxxx-xxxx-xxxx/providers/Microsoft.Security/autoProvisioningSettings/default",
            "Name": "default"
        }
    ]
}

Human Readable Output

Azure Security Center - Update Auto Provisioning Setting

Name	ID
default	/subscriptions/xxxx-xxxx-xxxx-xxxx-xxxx/providers/Microsoft.Security/autoProvisioningSettings/default

5. azure-sc-get-aps

Returns details of a specific auto provisioning setting.

Require Subscription ID

Base Command

azure-sc-get-aps

Input

Argument Name	Description	Required
setting_name	Name of the auto provisioning setting	Required
subscription_id	Subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscripton ID will be used.	Optional

Context Output

Path	Type	Description
AzureSecurityCenter.AutoProvisioningSetting.Name	string	Setting display name
AzureSecurityCenter.AutoProvisioningSetting.AutoProvision	string	Display the type of security agent provisioning action to take (On or Off)
AzureSecurityCenter.AutoProvisioningSetting.ID	string	Set resource ID

Command Example

!azure-sc-get-aps setting_name=default

Context Example

{
    "AzureSecurityCenter.AutoProvisioningSetting": [
        {
            "AutoProvision": "Off",
            "ID": "/subscriptions/0xxxx-xxxx-xxxx-xxxx-xxxx/providers/Microsoft.Security/autoProvisioningSettings/default",
            "Name": "default"
        }
    ]
}

Human Readable Output

Azure Security Center - Get Auto Provisioning Setting

Name	AutoProvision	ID
default	Off	/subscriptions/xxxx-xxxx-xxxx-xxxx-xxxx/providers/Microsoft.Security/autoProvisioningSettings/default

6. azure-sc-list-aps

Lists auto provisioning settings in the subscription.

Require Subscription ID

Base Command

azure-sc-list-aps

Input

Argument Name	Description	Required
subscription_id	Subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscripton ID will be used.	Optional

Context Output

Path	Type	Description
AzureSecurityCenter.AutoProvisioningSetting.Name	string	Setting display name
AzureSecurityCenter.AutoProvisioningSetting.AutoProvision	string	Display the type of security agent provisioning action to take (On or Off)
AzureSecurityCenter.AutoProvisioningSetting.ID	string	Setting resource ID

Command Example

!azure-sc-list-aps

Context Example

{
    "AzureSecurityCenter.AutoProvisioningSetting": [
        {
            "AutoProvision": "Off",
            "ID": "/subscriptions/xxxx-xxxx-xxxx-xxxx-xxxx/providers/Microsoft.Security/autoProvisioningSettings/default",
            "Name": "default"
        }
    ]
}

Human Readable Output

Azure Security Center - List Auto Provisioning Settings

Name	AutoProvision	ID
default	Off	/subscriptions/xxxx-xxxx-xxxx-xxxx-xxxx/providers/Microsoft.Security/autoProvisioningSettings/default

7. azure-sc-list-jit

Lists all policies for protecting resources using Just-in-Time access control.

Require Subscription ID

Base Command

azure-sc-list-jit

Input

Argument Name	Description	Required
asc_location	The location where Azure Security Center stores the data of the subscription. Run the ‘azure-sc-list-location’ command to get the asc_location.	Optional
resource_group_name	The name of the resource group within the user’s subscription. The name is case insensitive.	Optional
subscription_id	Subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscripton ID will be used.	Optional

Context Output

Path	Type	Description
AzureSecurityCenter.JITPolicy.Name	string	Poliyc display name
AzureSecurityCenter.JITPolicy.Rules	string	CSV list of access rules for Microsoft.Compute/virtualMachines resource, in the format (VMName: allowPort1,…)
AzureSecurityCenter.JITPolicy.Location	string	Location where the resource is stored
AzureSecurityCenter.JITPolicy.Kind	string	Policy resource type

Command Example

!azure-sc-list-jit

8. azure-sc-list-storage

Lists all the storage accounts available under the subscription.

Require Subscription ID

Base Command

azure-sc-list-storage

Input

Argument Name	Description	Required
subscription_id	Subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscripton ID will be used.	Optional

Context Output

Path	Type	Description
AzureSecurityCenter.Storage.Name	string	Name of the storage account
AzureSecurityCenter.Storage.ResourceGroupName	string	Names of the attached resource group
AzureSecurityCenter.Storage.Location	string	The geo-location where the resource resides

Command Example

!azure-sc-list-storage

Context Example

{
    "AzureSecurityCenter.Storage": [
        {
            "ID": "/subscriptions/xxxx-xxxx-xxxx-xxxx-xxxx/resourceGroups/cloud-shell-storage-eastus/providers/Microsoft.Storage/storageAccounts/cs20f907ea4bc8bx4c11x9d7",
            "Location": "eastus",
            "Name": "cs20f907ea4bc8bx4c11x9d7",
            "ResourceGroupName": "cloud-shell-storage-eastus"
        }
    ]
}

Human Readable Output

Azure Security Center - List Storage Accounts

Name	ResourceGroupName	Location
cs20f907ea4bc8bx4c11x9d7	cloud-shell-storage-eastus	eastus
useastrgdiag204	us-east-rg	eastus
demistodevops	cloud-shell-storage-eastus	westeurope

9. azure-list-subscriptions

List available subscriptions for this application.

Base Command

azure-list-subscriptions

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
Azure.Subscription.ID	String	Subscription ID
Azure.Subscription.Name	String	Subscription Name
Azure.Subscription.Enabled	String	Subscription state

Command Example

!azure-list-subscriptions

Context Example

{
    "Azure.Subscription": [
        {
            "ID": "/subscriptions/xxxx-xxxx-xxxx-xxxx-xxxx",
            "Name": "Pay-As-You-Go",
            "State": "Enabled"
        }
    ]
}

Human Readable Output

Azure Security Center - Subscriptions

ID	Name	State
/subscriptions/xxxx-xxxx-xxxx-xxxx-xxxx	Pay-As-You-Go	Enabled

List of Subscriptions

ID	Name	State
/subscriptions/xxxx-xxxx-xxxx-xxxx-xxxx	Pay-As-You-Go	Enabled

10. azure-sc-list-location

The location of the responsible ASC of the specific subscription. For each subscription there is only one responsible location.

Require Subscription ID

Base Command

azure-sc-list-location

Input

There are no input arguments for this command.

Context Output

There are no context output for this command.

Command Example

!azure-sc-list-location

Context Example

{
    "AzureSecurityCenter.Location": [
        {
            "HomeRegionName": "centralus",
            "ID": "/subscriptions/xxxx-xxxx-xxxx-xxxx-xxxx/providers/Microsoft.Security/locations/centralus",
            "Name": "centralus"
        }
    ]
}

Human Readable Output

Azure Security Center - List Locations

HomeRegionName	Name	ID
centralus	centralus	/subscriptions/xxxx-xxxx-xxxx-xxxx-xxxx/providers/Microsoft.Security/locations/centralus

11. azure-sc-get-alert

Get an alert that is associated a resource group or a subscription.

Require Subscription ID

Base Command

azure-sc-get-alert

Input

Argument Name	Description	Required
resource_group_name	The name of the resource group within the user’s subscription. The name is case insensitive.	Optional
asc_location	The location where Azure Security Center stores the data of the subscription. Run the ‘azure-sc-list-location’ command to get the ascLocation. This command requires the resourceGroupName argument.	Required
alert_id	The alert ID.	Optional

Context Output

Path	Type	Description
AzureSecurityCenter.Alert.DisplayName	string	The display name of the alert.
AzureSecurityCenter.Alert.CompromisedEntity	string	The entity on which the incident occurred.
AzureSecurityCenter.Alert.DetectedTime	date	The time the vendor detected the incident.
AzureSecurityCenter.Alert.ReportedSeverity	string	The estimated severity of the alert.
AzureSecurityCenter.Alert.State	string	The alert state (Active, Dismissed, etc.).
AzureSecurityCenter.Alert.RemediationSteps	string	Recommended steps to remediate the incident.
AzureSecurityCenter.Alert.VendorName	string	Name of the vendor that discovered the incident.
AzureSecurityCenter.Alert.AlertName	string	Name of the alert type.
AzureSecurityCenter.Alert.ID	string	The alert ID.
AzureSecurityCenter.Alert.Description	string	Description of the incident and what it means.
AzureSecurityCenter.Alert.ExtendedProperties	string	Changing set of properties depending on the alert type.
AzureSecurityCenter.Alert.Entities	string	Objects that are related to the alert.

Command Example

!azure-sc-get-alert asc_location="location" alert_id="alert_id"

Additional Information

For more information regarding roles, see the microsoft documentation.

12. azure-get-secure-score

Retrieve the Secure Score for the provided subscription and score name

Base Command

azure-get-secure-score

Input

Argument Name	Description	Required
secure_score_name	description. Possible values are: . Default is ascScore.	Optional
subscription_id	The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used. Possible values are: .	Optional

Context Output

Path	Type	Description
Azure.Securescore.displayName	String	The initiative’s name.
Azure.Securescore.score.max	String	The max score of the Securescore.
Azure.Securescore.score.current	String	The current score of the Securescore.
Azure.Securescore.score.percentage	String	The Ratio of the current score divided by the maximum.
Azure.Securescore.weight	String	The relative weight for each subscription.

Command Example


#### Context Example

```json
{
    "Azure": {
        "Securescore": {
            "displayName": "ASC score",
            "score": {
                "current": 14.51,
                "max": 58,
                "percentage": 0.2502
            },
            "weight": 199
        }
    }
}

Human Readable Output

Azure Security Center - Secure Score

displayName score weight

ASC score max: 58
current: 14.51
percentage: 0.2502 199

displayName	score	weight
ASC score	max: 58 current: 14.51 percentage: 0.2502	199

13. azure-sc-update-alert

Update an alert’s state.

Base Command

azure-sc-update-alert

Input

Argument Name	Description	Required
resource_group_name	The name of the resource group within the user’s subscription. The name is case insensitive.	Optional
asc_location	The location where Azure Security Center stores the data of the subscription. Run the ‘azure-sc-list-location’ command to get the ascLocation. This command requires the resourceGroupName argument.	Required
alert_id	The alert ID.	Required
subscription_id	The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used.	Optional
alert_update_action_type	The update action type. Possible values are: dismiss.	Required

Context Output

Path	Type	Description
AzureSecurityCenter.Alert.ActionTaken	string	The action that was taken on the alert.
AzureSecurityCenter.Alert.ID	string	The alert ID.

azure-sc-auth-reset

Run this command if for some reason you need to rerun the authentication process.

Base Command

azure-sc-auth-reset

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

azure-resource-group-list

List all resource groups for a subscription.

Base Command

azure-resource-group-list

Input

Argument Name	Description	Required
subscription_id	The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used.	Optional
limit	Limit on the number of resource groups to return. Default is 50.	Optional
tag	A single tag in the form of ‘{“Tag Name”:”Tag Value”}’ to filter the list by.	Optional

Context Output

Path	Type	Description
Azure.ResourceGroupName.name	String	Resource group name.
Azure.ResourceGroupName.location	String	Resource group location.
Azure.ResourceGroupName.tags	Unknown	Resource group tags.
Azure.ResourceGroupName.properties.provisioningState	unknown	Resource group provisioning state.

Configuration parameters

server_url — Microsoft Azure Management URL
auth_id — ID (received from the admin consent - see Detailed Instructions (?)
credentials_auth_id —
tenant_id — Token (received from the admin consent - see Detailed Instructions (?) section)
credentials_tenant_id —
enc_key — Key (received from the admin consent - see Detailed Instructions (?)
credentials_enc_key —
certificate_thumbprint — Certificate Thumbprint
credentials_certificate_thumbprint —
private_key — Private Key
default_sub_id — Default subscription ID to use
credentials_default_sub_id —
resource_group_name — Default Resource Group Name
use_managed_identities — Use Azure Managed Identities
managed_identities_client_id —
unsecure — Trust any certificate (not secure)
proxy — Use system proxy settings
self_deployed — Use a self-deployed Azure Application

Commands (15)

azure-get-secure-score
Retrieve the Secure Score for the provided subscription and score name.
azure-list-subscriptions
Lists available subscriptions for this application.
azure-resource-group-list
List all resource groups for a subscription.
azure-sc-auth-reset
Run this command if for some reason you need to rerun the authentication process.
azure-sc-get-alert
Gets an alert that is associated with a resource group or a subscription. The subscription_id argument is required in case it was not defined in the integration's configuration.
azure-sc-get-aps
Returns details of a specific auto provisioning setting.
azure-sc-get-atp
Returns the Advanced Threat Protection setting.
azure-sc-list-alert
Lists alerts for the subscription according to the specified filters.
azure-sc-list-aps
Lists auto provisioning settings in the subscription.
azure-sc-list-jit
Lists all policies for protecting resources using Just-in-Time access control.
azure-sc-list-location
The location of the responsible ASC of the specific subscription. For each subscription there is only one responsible location.
azure-sc-list-storage
Lists all the storage accounts available under the subscription.
azure-sc-update-alert
Update an alert's state.
azure-sc-update-aps
Updates a specific auto provisioning setting.
azure-sc-update-atp
Updates Advanced Threat Detection settings.

Source

AzureSecurityCenter_v2.py AzureSecurityCenter_v2_test.py AzureSecurityCenter_v2.yml AzureSecurityCenter_v2_description.md

Download History Raw

category: Analytics & SIEM
provider: Microsoft
commonfields:
  id: Azure Security Center v2
  version: -1
configuration:
- defaultvalue: https://management.azure.com/
  display: Microsoft Azure Management URL
  name: server_url
  type: 0
  required: false
  section: Connect
- display: ID (received from the admin consent - see Detailed Instructions (?)
  name: auth_id
  type: 4
  hidden: true
  required: false
  section: Connect
- displaypassword: ID (received from the admin consent - see Detailed Instructions (?)
  name: credentials_auth_id
  hiddenusername: true
  type: 9
  required: false
  section: Connect
- display: Token (received from the admin consent - see Detailed Instructions (?) section)
  name: tenant_id
  type: 4
  hidden: true
  required: false
  section: Connect
- displaypassword: Token (received from the admin consent - see Detailed Instructions (?) section)
  name: credentials_tenant_id
  hiddenusername: true
  type: 9
  required: false
  section: Connect
- display: Key (received from the admin consent - see Detailed Instructions (?)
  name: enc_key
  type: 4
  hidden: true
  required: false
  section: Connect
- displaypassword: Key (received from the admin consent - see Detailed Instructions (?)
  name: credentials_enc_key
  hiddenusername: true
  type: 9
  required: false
  section: Connect
- additionalinfo: Used for certificate authentication. As appears in the "Certificates & secrets" page of the app.
  display: Certificate Thumbprint
  name: certificate_thumbprint
  type: 4
  hidden: true
  required: false
  section: Connect
- additionalinfo: Used for certificate authentication. As appears in the "Certificates & secrets" page of the app.
  displaypassword: Certificate Thumbprint
  name: credentials_certificate_thumbprint
  hiddenusername: true
  type: 9
  required: false
  section: Connect
- additionalinfo: Used for certificate authentication. The private key of the registered certificate.
  display: Private Key
  name: private_key
  type: 14
  required: false
  section: Connect
- display: Default subscription ID to use
  name: default_sub_id
  type: 4
  hidden: true
  required: false
  section: Connect
- displaypassword: Default subscription ID
  name: credentials_default_sub_id
  hiddenusername: true
  type: 9
  required: false
  section: Connect
- additionalinfo: This parameter can be overridden by the resource_group_name argument in any command.
  display: Default Resource Group Name
  name: resource_group_name
  type: 0
  required: false
  section: Connect
- additionalinfo: Relevant only if the integration is running on Azure VM. If selected, authenticates based on the value provided for the Azure Managed Identities Client ID field. If no value is provided for the Azure Managed Identities Client ID field, authenticates based on the System Assigned Managed Identity. For additional information, see the Help tab.
  name: use_managed_identities
  type: 8
  required: false
  display: Use Azure Managed Identities
  section: Connect
- name: managed_identities_client_id
  type: 9
  required: false
  additionalinfo: The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM.
  displaypassword: Azure Managed Identities Client ID
  hiddenusername: true
  section: Connect
  advanced: true
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- additionalinfo: Select this checkbox if you are using a self-deployed Azure application.
  display: Use a self-deployed Azure Application
  name: self_deployed
  type: 8
  required: false
  section: Connect
  advanced: true
description: Unified security management and advanced threat protection across hybrid cloud workloads.
display: Microsoft Defender for Cloud
name: Azure Security Center v2
script:
  commands:
  - arguments:
    - description: "The name of the resource group within the user's subscription. The name is case insensitive. Note: This argument will override the instance parameter ‘Default Resource Group Name'."
      name: resource_group_name
    - description: The location where Azure Security Center stores the data of the subscription. Run the 'azure-sc-list-location' command to get the ascLocation. This command requires the resourceGroupName argument.
      name: asc_location
    - description: 'This argument is deprecated as it is no longer supported by Microsoft Defender for Cloud and has no effect. To filter alerts, use the ***azure-rg-query*** command from the Azure Resource Graph integration.'
      name: filter
      deprecated: true
      hidden: true
    - description: 'This argument is deprecated as it is no longer supported by Microsoft Defender for Cloud and has no effect. To filter alerts, use the ***azure-rg-query*** command from the Azure Resource Graph integration.'
      name: select
      deprecated: true
      hidden: true
    - description: 'This argument is deprecated as it is no longer supported by Microsoft Defender for Cloud and has no effect. To filter alerts, use the ***azure-rg-query*** command from the Azure Resource Graph integration.'
      name: expand
      deprecated: true
      hidden: true
    - description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used.
      name: subscription_id
    description: Lists alerts for the subscription according to the specified filters.
    name: azure-sc-list-alert
    outputs:
    - contextPath: AzureSecurityCenter.Alert.DisplayName
      description: The display name of the alert.
      type: string
    - contextPath: AzureSecurityCenter.Alert.CompromisedEntity
      description: The entity on which the incident occurred.
      type: string
    - contextPath: AzureSecurityCenter.Alert.Description
      description: Description of the suspicious activity that was detected.
      type: string
    - contextPath: AzureSecurityCenter.Alert.DetectedTime
      description: The time the vendor detected the incident.
      type: date
    - contextPath: AzureSecurityCenter.Alert.ReportedSeverity
      description: The estimated severity of this alert.
      type: string
    - contextPath: AzureSecurityCenter.Alert.State
      description: The alert state (Active, Dismissed, etc.).
      type: string
    - contextPath: AzureSecurityCenter.Alert.ID
      description: The alert ID.
      type: string
  - arguments:
    - description: "The name of the resource group within the user's subscription. The name is case insensitive. Note: This argument will override the instance parameter ‘Default Resource Group Name'."
      name: resource_group_name
    - description: The location where Azure Security Center stores the data of the subscription. Run the 'azure-sc-list-location' command to get the ascLocation. This command requires the resourceGroupName argument.
      name: asc_location
      required: true
    - description: The alert ID.
      name: alert_id
    - description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used.
      name: subscription_id
    description: Gets an alert that is associated with a resource group or a subscription. The subscription_id argument is required in case it was not defined in the integration's configuration.
    name: azure-sc-get-alert
    outputs:
    - contextPath: AzureSecurityCenter.Alert.DisplayName
      description: The display name of the alert.
      type: string
    - contextPath: AzureSecurityCenter.Alert.CompromisedEntity
      description: The entity on which the incident occurred.
      type: string
    - contextPath: AzureSecurityCenter.Alert.DetectedTime
      description: The time the vendor detected the incident.
      type: date
    - contextPath: AzureSecurityCenter.Alert.ReportedSeverity
      description: The estimated severity of the alert.
      type: string
    - contextPath: AzureSecurityCenter.Alert.State
      description: The alert state (Active, Dismissed, etc.).
      type: string
    - contextPath: AzureSecurityCenter.Alert.RemediationSteps
      description: Recommended steps to remediate the incident.
      type: string
    - contextPath: AzureSecurityCenter.Alert.VendorName
      description: Name of the vendor that discovered the incident.
      type: string
    - contextPath: AzureSecurityCenter.Alert.AlertName
      description: Name of the alert type.
      type: string
    - contextPath: AzureSecurityCenter.Alert.ID
      description: The alert ID.
      type: string
    - contextPath: AzureSecurityCenter.Alert.Description
      description: Description of the incident and what it means.
      type: string
    - contextPath: AzureSecurityCenter.Alert.ExtendedProperties
      description: Changing set of properties depending on the alert type.
      type: string
    - contextPath: AzureSecurityCenter.Alert.Entities
      description: Objects that are related to the alert.
      type: string
  - arguments:
    - description: "The name of the resource group within the user's subscription. The name is case insensitive. Note: This argument will override the instance parameter ‘Default Resource Group Name'."
      name: resource_group_name
    - description: The location where Azure Security Center stores the data of the subscription. Run the 'azure-sc-list-location' command to get the ascLocation. This command requires the resourceGroupName argument.
      name: asc_location
      required: true
    - description: The alert ID.
      name: alert_id
      required: true
    - description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used.
      name: subscription_id
    - description: The update action type.
      name: alert_update_action_type
      required: true
      auto: PREDEFINED
      predefined:
      - activate
#        - reactivate
      - dismiss
      - in_progress
      - resolve
    description: Update an alert's state.
    name: azure-sc-update-alert
    outputs:
    - contextPath: AzureSecurityCenter.Alert.ActionTaken
      description: The action that was taken on the alert.
      type: string
    - contextPath: AzureSecurityCenter.Alert.ID
      description: The alert ID.
      type: string
  - arguments:
    - description: "Resource group name. Note: This argument will override the instance parameter ‘Default Resource Group Name'."
      name: resource_group_name
    - default: true
      defaultValue: current
      description: Name of the Advanced Threat Detection setting.
      name: setting_name
    - description: The storage name in your Azure account.
      name: storage_account
      required: true
    - description: Indicates whether Advanced Threat Protection is enabled.
      name: is_enabled
      required: true
    - description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used.
      name: subscription_id
    description: Updates Advanced Threat Detection settings.
    name: azure-sc-update-atp
    outputs:
    - contextPath: AzureSecurityCenter.AdvancedThreatProtection.ID
      description: The resource ID.
      type: string
    - contextPath: AzureSecurityCenter.AdvancedThreatProtection.Name
      description: The name of the resource.
      type: string
    - contextPath: AzureSecurityCenter.AdvancedThreatProtection.IsEnabled
      description: Indicates whether the Advanced Threat Protection is enabled.
      type: string
  - arguments:
    - description: "Name of the resource group. Note: This argument will override the instance parameter ‘Default Resource Group Name'."
      name: resource_group_name
    - defaultValue: current
      description: Name of the Advanced Threat Detection setting. The default setting's name is 'current'.
      name: setting_name
    - description: Name of a storage in your azure account.
      name: storage_account
      required: true
    - description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used.
      name: subscription_id
    description: Returns the Advanced Threat Protection setting.
    name: azure-sc-get-atp
    outputs:
    - contextPath: AzureSecurityCenter.AdvancedThreatProtection.ID
      description: The resource ID.
      type: string
    - contextPath: AzureSecurityCenter.AdvancedThreatProtection.Name
      description: The name of the resource.
      type: string
    - contextPath: AzureSecurityCenter.AdvancedThreatProtection.IsEnabled
      description: Indicates whether the Advanced Threat Protection is enabled.
      type: string
  - arguments:
    - default: true
      defaultValue: default
      description: Name of the auto provisioning setting. The default setting's name is 'default'.
      name: setting_name
      required: true
    - description: Describes the type of security agent provisioning action to take (On or Off).
      name: auto_provision
      required: true
    - description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used.
      name: subscription_id
    description: Updates a specific auto provisioning setting.
    name: azure-sc-update-aps
    outputs:
    - contextPath: AzureSecurityCenter.AutoProvisioningSetting.Name
      description: The setting display name.
      type: string
    - contextPath: AzureSecurityCenter.AutoProvisioningSetting.AutoProvision
      description: Displays the type of security agent provisioning action to take (On or Off).
      type: string
    - contextPath: AzureSecurityCenter.AutoProvisioningSetting.ID
      description: The setting resource ID.
      type: string
  - arguments:
    - defaultValue: default
      description: Name of the auto provisioning setting.
      name: setting_name
      required: true
    - description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used.
      name: subscription_id
    description: Returns details of a specific auto provisioning setting.
    name: azure-sc-get-aps
    outputs:
    - contextPath: AzureSecurityCenter.AutoProvisioningSetting.Name
      description: The setting display name.
      type: string
    - contextPath: AzureSecurityCenter.AutoProvisioningSetting.AutoProvision
      description: Displays the type of security agent provisioning action to take (On or Off).
      type: string
    - contextPath: AzureSecurityCenter.AutoProvisioningSetting.ID
      description: The setting resource ID.
      type: string
  - arguments:
    - description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used.
      name: subscription_id
    description: Lists auto provisioning settings in the subscription.
    name: azure-sc-list-aps
    outputs:
    - contextPath: AzureSecurityCenter.AutoProvisioningSetting.Name
      description: The setting display name.
      type: string
    - contextPath: AzureSecurityCenter.AutoProvisioningSetting.AutoProvision
      description: Displays the type of security agent provisioning action to take (On or Off).
      type: string
    - contextPath: AzureSecurityCenter.AutoProvisioningSetting.ID
      description: The setting resource ID.
      type: string
  - arguments:
    - description: The location where Azure Security Center stores the data of the subscription. Run the 'azure-sc-list-location' command to get the asc_location.
      name: asc_location
    - description: "The name of the resource group within the user's subscription. The name is case insensitive. Note: This argument will override the instance parameter ‘Default Resource Group Name'."
      name: resource_group_name
    - description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used.
      name: subscription_id
    description: Lists all policies for protecting resources using Just-in-Time access control.
    name: azure-sc-list-jit
    outputs:
    - contextPath: AzureSecurityCenter.JITPolicy.Name
      description: The display name of the policy.
      type: string
    - contextPath: AzureSecurityCenter.JITPolicy.Rules
      description: 'A CSV list of access rules for Microsoft.Compute/virtualMachines resource, in the format (VMName: allowPort1,...)'
      type: string
    - contextPath: AzureSecurityCenter.JITPolicy.Location
      description: The location where the resource is stored.
      type: string
    - contextPath: AzureSecurityCenter.JITPolicy.Kind
      description: The resource type of the policy.
      type: string
  - arguments:
    - description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used.
      name: subscription_id
    description: Lists all the storage accounts available under the subscription.
    name: azure-sc-list-storage
    outputs:
    - contextPath: AzureSecurityCenter.Storage.Name
      description: Name of the storage account.
      type: string
    - contextPath: AzureSecurityCenter.Storage.ResourceGroupName
      description: Name of the attached resource group.
      type: string
    - contextPath: AzureSecurityCenter.Storage.Location
      description: The geo-location where the resource resides.
      type: string
  - description: Lists available subscriptions for this application.
    name: azure-list-subscriptions
    outputs:
    - contextPath: Azure.Subscription.ID
      description: The ID of the subscription.
      type: String
    - contextPath: Azure.Subscription.Name
      description: The name of the subscription.
      type: String
    - contextPath: Azure.Subscription.Enabled
      description: The state of the subscription.
      type: String
  - arguments:
    - description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used.
      name: subscription_id
    description: The location of the responsible ASC of the specific subscription. For each subscription there is only one responsible location.
    name: azure-sc-list-location
  - name: azure-get-secure-score
    description: Retrieve the Secure Score for the provided subscription and score name.
    arguments:
    - name: secure_score_name
      description: description.
      defaultValue: ascScore
      predefined:
      - ""
    - name: subscription_id
      description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used.
      defaultValue: ""
      predefined:
      - ""
    outputs:
    - contextPath: Azure.Securescore.displayName
      description: The initiative’s name.
      type: String
    - contextPath: Azure.Securescore.score.max
      description: The max score of the Securescore.
      type: String
    - contextPath: Azure.Securescore.score.current
      description: The current score of the Securescore.
      type: String
    - contextPath: Azure.Securescore.score.percentage
      description: The Ratio of the current score divided by the maximum.
      type: String
    - contextPath: Azure.Securescore.weight
      description: The relative weight for each subscription.
      type: String
  - description: Run this command if for some reason you need to rerun the authentication process.
    execution: false
    name: azure-sc-auth-reset
    arguments: []
  - name: azure-resource-group-list
    description: List all resource groups for a subscription.
    arguments:
    - name: subscription_id
      description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used.
    - name: limit
      description: Limit on the number of resource groups to return.
      defaultValue: 50
    - name: tag
      description: A single tag in the form of '{"Tag Name":"Tag Value"}' to filter the list by.
    outputs:
    - contextPath: Azure.ResourceGroupName.name
      description: Resource group name.
      type: String
    - contextPath: Azure.ResourceGroupName.location
      description: Resource group location.
      type: String
    - contextPath: Azure.ResourceGroupName.tags
      description: Resource group tags.
      type: Unknown
    - contextPath: Azure.ResourceGroupName.properties.provisioningState
      description: Resource group provisioning state.
  dockerimage: demisto/crypto:1.0.0.10120494
  runonce: false
  script: '-'
  type: python
  subtype: python3
tests:
- Azure SecurityCenter - Test
fromversion: 5.0.0
sectionorder:
- Connect
- Collect