category: Analytics & SIEM provider: Microsoft commonfields: id: Azure Security Center v2 version: -1 configuration: - defaultvalue: https://management.azure.com/ display: Microsoft Azure Management URL name: server_url type: 0 required: false section: Connect - display: ID (received from the admin consent - see Detailed Instructions (?) name: auth_id type: 4 hidden: true required: false section: Connect - displaypassword: ID (received from the admin consent - see Detailed Instructions (?) name: credentials_auth_id hiddenusername: true type: 9 required: false section: Connect - display: Token (received from the admin consent - see Detailed Instructions (?) section) name: tenant_id type: 4 hidden: true required: false section: Connect - displaypassword: Token (received from the admin consent - see Detailed Instructions (?) section) name: credentials_tenant_id hiddenusername: true type: 9 required: false section: Connect - display: Key (received from the admin consent - see Detailed Instructions (?) name: enc_key type: 4 hidden: true required: false section: Connect - displaypassword: Key (received from the admin consent - see Detailed Instructions (?) name: credentials_enc_key hiddenusername: true type: 9 required: false section: Connect - additionalinfo: Used for certificate authentication. As appears in the "Certificates & secrets" page of the app. display: Certificate Thumbprint name: certificate_thumbprint type: 4 hidden: true required: false section: Connect - additionalinfo: Used for certificate authentication. As appears in the "Certificates & secrets" page of the app. displaypassword: Certificate Thumbprint name: credentials_certificate_thumbprint hiddenusername: true type: 9 required: false section: Connect - additionalinfo: Used for certificate authentication. The private key of the registered certificate. display: Private Key name: private_key type: 14 required: false section: Connect - display: Default subscription ID to use name: default_sub_id type: 4 hidden: true required: false section: Connect - displaypassword: Default subscription ID name: credentials_default_sub_id hiddenusername: true type: 9 required: false section: Connect - additionalinfo: This parameter can be overridden by the resource_group_name argument in any command. display: Default Resource Group Name name: resource_group_name type: 0 required: false section: Connect - additionalinfo: Relevant only if the integration is running on Azure VM. If selected, authenticates based on the value provided for the Azure Managed Identities Client ID field. If no value is provided for the Azure Managed Identities Client ID field, authenticates based on the System Assigned Managed Identity. For additional information, see the Help tab. name: use_managed_identities type: 8 required: false display: Use Azure Managed Identities section: Connect - name: managed_identities_client_id type: 9 required: false additionalinfo: The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM. displaypassword: Azure Managed Identities Client ID hiddenusername: true section: Connect advanced: true - display: Trust any certificate (not secure) name: unsecure type: 8 required: false section: Connect advanced: true - display: Use system proxy settings name: proxy type: 8 required: false section: Connect advanced: true - additionalinfo: Select this checkbox if you are using a self-deployed Azure application. display: Use a self-deployed Azure Application name: self_deployed type: 8 required: false section: Connect advanced: true description: Unified security management and advanced threat protection across hybrid cloud workloads. display: Microsoft Defender for Cloud name: Azure Security Center v2 script: commands: - arguments: - description: "The name of the resource group within the user's subscription. The name is case insensitive. Note: This argument will override the instance parameter ‘Default Resource Group Name'." name: resource_group_name - description: The location where Azure Security Center stores the data of the subscription. Run the 'azure-sc-list-location' command to get the ascLocation. This command requires the resourceGroupName argument. name: asc_location - description: 'This argument is deprecated as it is no longer supported by Microsoft Defender for Cloud and has no effect. To filter alerts, use the ***azure-rg-query*** command from the Azure Resource Graph integration.' name: filter deprecated: true hidden: true - description: 'This argument is deprecated as it is no longer supported by Microsoft Defender for Cloud and has no effect. To filter alerts, use the ***azure-rg-query*** command from the Azure Resource Graph integration.' name: select deprecated: true hidden: true - description: 'This argument is deprecated as it is no longer supported by Microsoft Defender for Cloud and has no effect. To filter alerts, use the ***azure-rg-query*** command from the Azure Resource Graph integration.' name: expand deprecated: true hidden: true - description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used. name: subscription_id description: Lists alerts for the subscription according to the specified filters. name: azure-sc-list-alert outputs: - contextPath: AzureSecurityCenter.Alert.DisplayName description: The display name of the alert. type: string - contextPath: AzureSecurityCenter.Alert.CompromisedEntity description: The entity on which the incident occurred. type: string - contextPath: AzureSecurityCenter.Alert.Description description: Description of the suspicious activity that was detected. type: string - contextPath: AzureSecurityCenter.Alert.DetectedTime description: The time the vendor detected the incident. type: date - contextPath: AzureSecurityCenter.Alert.ReportedSeverity description: The estimated severity of this alert. type: string - contextPath: AzureSecurityCenter.Alert.State description: The alert state (Active, Dismissed, etc.). type: string - contextPath: AzureSecurityCenter.Alert.ID description: The alert ID. type: string - arguments: - description: "The name of the resource group within the user's subscription. The name is case insensitive. Note: This argument will override the instance parameter ‘Default Resource Group Name'." name: resource_group_name - description: The location where Azure Security Center stores the data of the subscription. Run the 'azure-sc-list-location' command to get the ascLocation. This command requires the resourceGroupName argument. name: asc_location required: true - description: The alert ID. name: alert_id - description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used. name: subscription_id description: Gets an alert that is associated with a resource group or a subscription. The subscription_id argument is required in case it was not defined in the integration's configuration. name: azure-sc-get-alert outputs: - contextPath: AzureSecurityCenter.Alert.DisplayName description: The display name of the alert. type: string - contextPath: AzureSecurityCenter.Alert.CompromisedEntity description: The entity on which the incident occurred. type: string - contextPath: AzureSecurityCenter.Alert.DetectedTime description: The time the vendor detected the incident. type: date - contextPath: AzureSecurityCenter.Alert.ReportedSeverity description: The estimated severity of the alert. type: string - contextPath: AzureSecurityCenter.Alert.State description: The alert state (Active, Dismissed, etc.). type: string - contextPath: AzureSecurityCenter.Alert.RemediationSteps description: Recommended steps to remediate the incident. type: string - contextPath: AzureSecurityCenter.Alert.VendorName description: Name of the vendor that discovered the incident. type: string - contextPath: AzureSecurityCenter.Alert.AlertName description: Name of the alert type. type: string - contextPath: AzureSecurityCenter.Alert.ID description: The alert ID. type: string - contextPath: AzureSecurityCenter.Alert.Description description: Description of the incident and what it means. type: string - contextPath: AzureSecurityCenter.Alert.ExtendedProperties description: Changing set of properties depending on the alert type. type: string - contextPath: AzureSecurityCenter.Alert.Entities description: Objects that are related to the alert. type: string - arguments: - description: "The name of the resource group within the user's subscription. The name is case insensitive. Note: This argument will override the instance parameter ‘Default Resource Group Name'." name: resource_group_name - description: The location where Azure Security Center stores the data of the subscription. Run the 'azure-sc-list-location' command to get the ascLocation. This command requires the resourceGroupName argument. name: asc_location required: true - description: The alert ID. name: alert_id required: true - description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used. name: subscription_id - description: The update action type. name: alert_update_action_type required: true auto: PREDEFINED predefined: - activate # - reactivate - dismiss - in_progress - resolve description: Update an alert's state. name: azure-sc-update-alert outputs: - contextPath: AzureSecurityCenter.Alert.ActionTaken description: The action that was taken on the alert. type: string - contextPath: AzureSecurityCenter.Alert.ID description: The alert ID. type: string - arguments: - description: "Resource group name. Note: This argument will override the instance parameter ‘Default Resource Group Name'." name: resource_group_name - default: true defaultValue: current description: Name of the Advanced Threat Detection setting. name: setting_name - description: The storage name in your Azure account. name: storage_account required: true - description: Indicates whether Advanced Threat Protection is enabled. name: is_enabled required: true - description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used. name: subscription_id description: Updates Advanced Threat Detection settings. name: azure-sc-update-atp outputs: - contextPath: AzureSecurityCenter.AdvancedThreatProtection.ID description: The resource ID. type: string - contextPath: AzureSecurityCenter.AdvancedThreatProtection.Name description: The name of the resource. type: string - contextPath: AzureSecurityCenter.AdvancedThreatProtection.IsEnabled description: Indicates whether the Advanced Threat Protection is enabled. type: string - arguments: - description: "Name of the resource group. Note: This argument will override the instance parameter ‘Default Resource Group Name'." name: resource_group_name - defaultValue: current description: Name of the Advanced Threat Detection setting. The default setting's name is 'current'. name: setting_name - description: Name of a storage in your azure account. name: storage_account required: true - description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used. name: subscription_id description: Returns the Advanced Threat Protection setting. name: azure-sc-get-atp outputs: - contextPath: AzureSecurityCenter.AdvancedThreatProtection.ID description: The resource ID. type: string - contextPath: AzureSecurityCenter.AdvancedThreatProtection.Name description: The name of the resource. type: string - contextPath: AzureSecurityCenter.AdvancedThreatProtection.IsEnabled description: Indicates whether the Advanced Threat Protection is enabled. type: string - arguments: - default: true defaultValue: default description: Name of the auto provisioning setting. The default setting's name is 'default'. name: setting_name required: true - description: Describes the type of security agent provisioning action to take (On or Off). name: auto_provision required: true - description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used. name: subscription_id description: Updates a specific auto provisioning setting. name: azure-sc-update-aps outputs: - contextPath: AzureSecurityCenter.AutoProvisioningSetting.Name description: The setting display name. type: string - contextPath: AzureSecurityCenter.AutoProvisioningSetting.AutoProvision description: Displays the type of security agent provisioning action to take (On or Off). type: string - contextPath: AzureSecurityCenter.AutoProvisioningSetting.ID description: The setting resource ID. type: string - arguments: - defaultValue: default description: Name of the auto provisioning setting. name: setting_name required: true - description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used. name: subscription_id description: Returns details of a specific auto provisioning setting. name: azure-sc-get-aps outputs: - contextPath: AzureSecurityCenter.AutoProvisioningSetting.Name description: The setting display name. type: string - contextPath: AzureSecurityCenter.AutoProvisioningSetting.AutoProvision description: Displays the type of security agent provisioning action to take (On or Off). type: string - contextPath: AzureSecurityCenter.AutoProvisioningSetting.ID description: The setting resource ID. type: string - arguments: - description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used. name: subscription_id description: Lists auto provisioning settings in the subscription. name: azure-sc-list-aps outputs: - contextPath: AzureSecurityCenter.AutoProvisioningSetting.Name description: The setting display name. type: string - contextPath: AzureSecurityCenter.AutoProvisioningSetting.AutoProvision description: Displays the type of security agent provisioning action to take (On or Off). type: string - contextPath: AzureSecurityCenter.AutoProvisioningSetting.ID description: The setting resource ID. type: string - arguments: - description: The location where Azure Security Center stores the data of the subscription. Run the 'azure-sc-list-location' command to get the asc_location. name: asc_location - description: "The name of the resource group within the user's subscription. The name is case insensitive. Note: This argument will override the instance parameter ‘Default Resource Group Name'." name: resource_group_name - description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used. name: subscription_id description: Lists all policies for protecting resources using Just-in-Time access control. name: azure-sc-list-jit outputs: - contextPath: AzureSecurityCenter.JITPolicy.Name description: The display name of the policy. type: string - contextPath: AzureSecurityCenter.JITPolicy.Rules description: 'A CSV list of access rules for Microsoft.Compute/virtualMachines resource, in the format (VMName: allowPort1,...)' type: string - contextPath: AzureSecurityCenter.JITPolicy.Location description: The location where the resource is stored. type: string - contextPath: AzureSecurityCenter.JITPolicy.Kind description: The resource type of the policy. type: string - arguments: - description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used. name: subscription_id description: Lists all the storage accounts available under the subscription. name: azure-sc-list-storage outputs: - contextPath: AzureSecurityCenter.Storage.Name description: Name of the storage account. type: string - contextPath: AzureSecurityCenter.Storage.ResourceGroupName description: Name of the attached resource group. type: string - contextPath: AzureSecurityCenter.Storage.Location description: The geo-location where the resource resides. type: string - description: Lists available subscriptions for this application. name: azure-list-subscriptions outputs: - contextPath: Azure.Subscription.ID description: The ID of the subscription. type: String - contextPath: Azure.Subscription.Name description: The name of the subscription. type: String - contextPath: Azure.Subscription.Enabled description: The state of the subscription. type: String - arguments: - description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used. name: subscription_id description: The location of the responsible ASC of the specific subscription. For each subscription there is only one responsible location. name: azure-sc-list-location - name: azure-get-secure-score description: Retrieve the Secure Score for the provided subscription and score name. arguments: - name: secure_score_name description: description. defaultValue: ascScore predefined: - "" - name: subscription_id description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used. defaultValue: "" predefined: - "" outputs: - contextPath: Azure.Securescore.displayName description: The initiative’s name. type: String - contextPath: Azure.Securescore.score.max description: The max score of the Securescore. type: String - contextPath: Azure.Securescore.score.current description: The current score of the Securescore. type: String - contextPath: Azure.Securescore.score.percentage description: The Ratio of the current score divided by the maximum. type: String - contextPath: Azure.Securescore.weight description: The relative weight for each subscription. type: String - description: Run this command if for some reason you need to rerun the authentication process. execution: false name: azure-sc-auth-reset arguments: [] - name: azure-resource-group-list description: List all resource groups for a subscription. arguments: - name: subscription_id description: The subscription ID to use. Can be retrieved from the azure-sc-list-subscriptions command. If not specified, the default subscription ID is used. - name: limit description: Limit on the number of resource groups to return. defaultValue: 50 - name: tag description: A single tag in the form of '{"Tag Name":"Tag Value"}' to filter the list by. outputs: - contextPath: Azure.ResourceGroupName.name description: Resource group name. type: String - contextPath: Azure.ResourceGroupName.location description: Resource group location. type: String - contextPath: Azure.ResourceGroupName.tags description: Resource group tags. type: Unknown - contextPath: Azure.ResourceGroupName.properties.provisioningState description: Resource group provisioning state. dockerimage: demisto/crypto:1.0.0.10120494 runonce: false script: '-' type: python subtype: python3 tests: - Azure SecurityCenter - Test fromversion: 5.0.0 sectionorder: - Connect - Collect