category: Analytics & SIEM provider: Microsoft commonfields: id: Azure Security Center version: -1 configuration: - defaultvalue: https://management.azure.com display: Microsoft Azure Management URL name: server_url type: 0 required: false - display: Tenant ID (received from the admin consent - see Detailed Instructions (?) section) name: tenant_id required: true type: 4 - display: Token (received from the admin consent - see detailed instructions (?)) name: token required: true type: 4 - display: Trust any certificate (not secure) name: unsecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false description: Deprecated. Unified security management and advanced threat protection across hybrid cloud workloads. display: Azure Security Center (Deprecated) name: Azure Security Center script: commands: - arguments: - description: The name of the resource group within the user's subscription. The name is case insensitive. name: resource_group_name - description: The location where Azure Security Center stores the data of the subscription. Run the 'azure-sc-location-list' command to get the ascLocation. This command requires the resourceGroupName argument. name: asc_location - description: OData filter name: filter - description: OData select name: select - description: OData expand name: expand deprecated: true description: Lists alerts for the subscription according to the specified filters. name: azure-sc-list-alert outputs: - contextPath: AzureSecurityCenter.Alert.AlertDisplayName description: Alert display name type: string - contextPath: AzureSecurityCenter.Alert.CompromisedEntity description: The entity on which the incident occurred type: string - contextPath: AzureSecurityCenter.Alert.DetectedTimeUtc description: Time the vendor detected the incident type: date - contextPath: AzureSecurityCenter.Alert.ReportedSeverity description: Estimated severity of this alert type: string - contextPath: AzureSecurityCenter.Alert.State description: Alert state (Active, Dismissed, etc.) type: string - contextPath: AzureSecurityCenter.Alert.ID description: Alert ID type: string - arguments: - description: Resource group name name: resource_group_name required: true - default: true defaultValue: current description: Name of the Advanced Threat Detection setting, default is 'current'. name: setting_name - description: Storage name in your Azure account name: storage_account required: true - description: Indicates whether Advanced Threat Protection is enabled. name: is_enabled required: true deprecated: true description: Updates Advanced Threat Detection settings. name: azure-sc-update-atp outputs: - contextPath: AzureSecurityCenter.AdvancedThreatProtection.ID description: Resource ID type: string - contextPath: AzureSecurityCenter.AdvancedThreatProtection.Name description: Resource Name type: string - contextPath: AzureSecurityCenter.AdvancedThreatProtection.IsEnabled description: Indicates whether Advanced Threat Protection is enabled type: string - arguments: - description: Name of the resource group. name: resource_group_name required: true - defaultValue: current description: Name of Advanced Threat Detection setting, default setting's name is 'current'. name: setting_name - description: Name of a storage in your azure account. name: storage_account required: true deprecated: true description: Returns the Advanced Threat Protection setting. name: azure-sc-get-atp outputs: - contextPath: AzureSecurityCenter.AdvancedThreatProtection.ID description: Resource ID type: string - contextPath: AzureSecurityCenter.AdvancedThreatProtection.Name description: Resource name type: string - contextPath: AzureSecurityCenter.AdvancedThreatProtection.IsEnabled description: Indicates whether Advanced Threat Protection is enabled type: string - arguments: - default: true defaultValue: default description: Name of the auto provisioning setting, default setting's name is 'default' name: setting_name required: true - description: Describes the type of security agent provisioning action to take (On or Off) name: auto_provision required: true deprecated: true description: Updates a specific auto provisioning setting. name: azure-sc-update-aps outputs: - contextPath: AzureSecurityCenter.AutoProvisioningSetting.Name description: Setting display name type: string - contextPath: AzureSecurityCenter.AutoProvisioningSetting.AutoProvision description: Display the type of security agent provisioning action to take (On or Off) type: string - contextPath: AzureSecurityCenter.AutoProvisioningSetting.ID description: Setting resource ID type: string - arguments: - defaultValue: default description: Name of the auto provisioning setting name: setting_name required: true deprecated: true description: Returns details of a specific auto provisioning setting. name: azure-sc-get-aps outputs: - contextPath: AzureSecurityCenter.AutoProvisioningSetting.Name description: Setting display name type: string - contextPath: AzureSecurityCenter.AutoProvisioningSetting.AutoProvision description: Display the type of security agent provisioning action to take (On or Off) type: string - contextPath: AzureSecurityCenter.AutoProvisioningSetting.ID description: Set resource ID type: string - deprecated: true description: Lists auto provisioning settings in the subscription. name: azure-sc-list-aps outputs: - contextPath: AzureSecurityCenter.AutoProvisioningSetting.Name description: Setting display name type: string - contextPath: AzureSecurityCenter.AutoProvisioningSetting.AutoProvision description: Display the type of security agent provisioning action to take (On or Off) type: string - contextPath: AzureSecurityCenter.AutoProvisioningSetting.ID description: Setting resource ID type: string - arguments: - description: The location where Azure Security Center stores the data of the subscription. Run the 'azure-sc-list-location' command to get the asc_location. name: asc_location - description: The name of the resource group within the user's subscription. The name is case insensitive. name: resource_group_name deprecated: true description: Lists all policies for protecting resources using Just-in-Time access control. name: azure-sc-list-jit outputs: - contextPath: AzureSecurityCenter.JITPolicy.Name description: Poliyc display name type: string - contextPath: AzureSecurityCenter.JITPolicy.Rules description: 'CSV list of access rules for Microsoft.Compute/virtualMachines resource, in the format (VMName: allowPort1,...)' type: string - contextPath: AzureSecurityCenter.JITPolicy.Location description: Location where the resource is stored type: string - contextPath: AzureSecurityCenter.JITPolicy.Kind description: Policy resource type type: string - deprecated: true description: Lists all the storage accounts available under the subscription. name: azure-sc-list-storage outputs: - contextPath: AzureSecurityCenter.Storage.Name description: Name of the storage account type: string - contextPath: AzureSecurityCenter.Storage.ResourceGroupName description: Names of the attached resource group type: string - contextPath: AzureSecurityCenter.Storage.Location description: The geo-location where the resource resides type: string runonce: false script: '-' type: python subtype: python2 dockerimage: demisto/python:2.7.18.20958 tests: - No tests deprecated: true fromversion: 5.0.0