Azure Sentinel

Microsoft Sentinel is a scalable, cloud-native solution that provides: Security information and event management (SIEM) Security orchestration, automation, and response (SOAR).

Category

Analytics & SIEM

Pack

AzureSentinel

Configuration parameters

• azure_cloud — Azure Cloud
• limit — Maximum number of incidents per fetch.
• creds_tenant_id —
• tenant_id — Tenant ID
• creds_client_id —
• credentials —
• creds_certificate — Certificate Thumbprint
• certificate_thumbprint — Certificate Thumbprint
• private_key — Private Key
• use_managed_identities — Use Azure Managed Identities
• managed_identities_client_id —
• subscriptionID — Default Subscription ID (required)
• resourceGroupName — Default Resource Group Name (required)
• workspaceName — Workspace Name (required)
• isFetch — Fetch incidents
• fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
• min_severity — The minimum severity of incidents to fetch
• incidentType — Incident type
• server_url — Server URL
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• fetch_additional_info — Additional info to fetch
• mirror_direction — Mirroring Direction
• close_incident — Close Mirrored XSOAR Incident
• close_ticket — Close Mirrored Microsoft Sentinel Ticket
• statuses_to_fetch — Incident Statuses to Fetch
• incidentFetchInterval — Incidents Fetch Interval
• look_back — Minutes to look back when fetching
• titles_to_not_fetch — Incident Titles to Not Fetch
• alert_product_names_to_not_fetch — Alert Product Names to Not Fetch

Commands (36)

• azure-sentinel-auth-reset — Run this command if for some reason you need to rerun the authentication process.
• azure-sentinel-create-alert-rule — Creates a new alert rule.
• azure-sentinel-create-incident — Create a sentinel incident.
• azure-sentinel-create-update-watchlist-item — Create or update a watchlist item.
• azure-sentinel-delete-alert-rule — Deletes the specified alert rule.
• azure-sentinel-delete-incident — Deletes a single incident in Azure Sentinel.
• azure-sentinel-delete-watchlist — Delete a watchlist from Azure Sentinel.
• azure-sentinel-delete-watchlist-item — Delete a watchlist item.
• azure-sentinel-get-incident-by-id — Gets a single incident from Azure Sentinel.
• azure-sentinel-incident-add-comment — Adds a comment to an incident in Azure Sentinel.
• azure-sentinel-incident-delete-comment — Deletes a comment from incident in Azure Sentinel.
• azure-sentinel-list-alert-rule — Gets a list of all alert rules.
• azure-sentinel-list-alert-rule-template — Gets a list of all alert rule templates.
• azure-sentinel-list-incident-alerts — Gets a list of an incident's alerts from Azure Sentinel.
• azure-sentinel-list-incident-comments — Gets the comments of an incident from Azure Sentinel.
• azure-sentinel-list-incident-entities — Gets a list of an incident's entities from Azure Sentinel.
• azure-sentinel-list-incident-relations — Gets a list of an incident's related entities from Azure Sentinel.
• azure-sentinel-list-incidents — Gets a list of incidents from Azure Sentinel.
• azure-sentinel-list-watchlist-items — Get a single watchlist item or list of watchlist items.
• azure-sentinel-list-watchlists — Gets a list of watchlists from Azure Sentinel.
• azure-sentinel-resource-group-list — List all resource groups for a subscription.
• azure-sentinel-subscriptions-list — Lists all subscriptions.
• azure-sentinel-threat-indicator-create — Creates a new threat indicator.
• azure-sentinel-threat-indicator-delete — Deletes an existing threat indicator.
• azure-sentinel-threat-indicator-list — Returns a list of threat indicators.
• azure-sentinel-threat-indicator-query — Returns a list of threat indicators with specific entities.
• azure-sentinel-threat-indicator-tags-append — Appends new tags to an existing indicator.
• azure-sentinel-threat-indicator-tags-replace — Replaces the tags of a given indicator.
• azure-sentinel-threat-indicator-update — Updates an existing threat indicator.
• azure-sentinel-update-alert-rule — Updates an alert rule.
• azure-sentinel-update-incident — Updates a single incident in Azure Sentinel.
• azure-sentinel-watchlist-create-update — Create or update a watchlist in Azure Sentinel.
• get-mapping-fields — Returns the list of fields to map in outgoing mirroring. This command is only used for debugging purposes.
• get-modified-remote-data — Gets the list of incidents and detections that were modified since the last update time. This method is used for debugging purposes.
• get-remote-data — Gets data from a remote incident. This method does not update the current incident, and should be used for debugging purposes only.
• update-remote-system — Updates the remote incident with local incident changes. This method is only used for debugging purposes and will not update the current incident.