You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
With [Azure Logic Apps](../logic-apps/logic-apps-overview.md)and the [Microsoft Graph Security](/graph/security-concept-overview) connector, you can improve how your app detects, protects, and responds to threats by creating automated workflows for integrating Microsoft security products, services, and partners. For example, you can create [Microsoft Defender for Cloud playbooks](../security-center/workflow-automation.yml) that monitor and manage Microsoft Graph Security entities, such as alerts. Here are some scenarios that the Microsoft Graph Security connector supports:
18
+
By using [Azure Logic Apps](../logic-apps/logic-apps-overview.md)with the [Microsoft Graph Security](/graph/security-concept-overview) connector, you can improve how your app detects, protects, and responds to threats by creating automated workflows for integrating Microsoft security products, services, and partners. For example, you can create [Microsoft Defender for Cloud playbooks](../security-center/workflow-automation.yml) that monitor and manage Microsoft Graph Security entities, such as alerts. Here are some scenarios that the Microsoft Graph Security connector supports:
19
19
20
20
- Get alerts based on queries or by alert ID. For example, get a list that includes high severity alerts.
21
21
22
22
- Update alerts. For example, update alert assignments, add comments to alerts, or tag alerts.
23
23
24
-
- Monitor when alerts are created or changed by creating [alert subscriptions (webhooks)](/graph/api/resources/change-notifications-api-overview?view=graph-rest-1.0).
24
+
- Monitor when alerts are created or changed by creating [alert subscriptions (webhooks)](/graph/api/resources/change-notifications-api-overview).
25
25
26
26
- Manage your alert subscriptions. For example, get active subscriptions, extend the expiration time for a subscription, or delete a subscription.
27
27
@@ -31,72 +31,72 @@ Your logic app's workflow can use actions that get responses from the Microsoft
31
31
32
32
- An Azure account and subscription. [Get a free Azure account](https://azure.microsoft.com/pricing/purchase-options/azure-account?cid=msft_learn).
33
33
34
-
- To use the Microsoft Graph Security connector, you must *explicitly give* Microsoft Entra tenant administrator consent, which is part of the [Microsoft Graph Security Authentication requirements](/graph/security-authorization). This consent requires the Microsoft Graph Security connector's application ID and name, which you can also find in the [Azure portal](https://portal.azure.com):
34
+
- To use the Microsoft Graph Security connector, you must *explicitly give*the Microsoft Entra tenant administrator consent, which is part of the [Microsoft Graph Security Authentication requirements](/graph/security-authorization). This consent requires the Microsoft Graph Security connector's application ID and name, which you can also find in the [Azure portal](https://portal.azure.com):
To grant consent for the connector, take one of the following actions:
41
+
To grant consent for the connector, do one of the following actions:
42
42
43
43
-[Request tenant administrator consent be granted for Microsoft Entra applications](../active-directory/develop/v2-permissions-and-consent.md).
44
44
45
45
- During your logic app's first run, have your app request consent from your Microsoft Entra tenant administrator through the [application consent experience](../active-directory/develop/application-consent-experience.md).
46
46
47
-
- Basic knowledge about how to create logic apps.
47
+
- Basic knowledge of how to create logic apps.
48
48
49
-
-The logic app where you want to access your Microsoft Graph Security entities, such as alerts. To use a Microsoft Graph Security trigger, you need a blank logic app. To use a Microsoft Graph Security action, you need a logic app that starts with the appropriate trigger for your scenario.
49
+
-A logic app in which you want to access Microsoft Graph Security entities, such as alerts. To use a Microsoft Graph Security trigger, you need a blank logic app. To use a Microsoft Graph Security action, you need a logic app that starts with the appropriate trigger for your scenario.
50
50
51
51
## Connect to Microsoft Graph Security
52
52
53
53
[!INCLUDE [Create connection general intro](../../includes/connectors-create-connection-general-intro.md)]
54
54
55
-
1. Sign in to the [Azure portal](https://portal.azure.com/), and open your logic app in Logic App Designer, if not open already.
55
+
1. Sign in to the [Azure portal](https://portal.azure.com/), and open your logic app in Logic App Designer.
56
56
57
57
1. Based on your logic app, do one of these steps:
58
58
59
-
1. For blank logic apps, add the trigger and any other actions that you want before you add a Microsoft Graph Security action.
59
+
- For blank logic apps, add the trigger and any other actions that you want before you add a Microsoft Graph Security action.
60
60
61
-
1. For existing logic apps, under the last step where you want to add a Microsoft Graph Security action, select **New step**.
61
+
- For existing logic apps, under the last step where you want to add a Microsoft Graph Security action, select **New step**.
62
62
63
63
1. To add an action between steps, move your pointer over the arrow between steps. Select the plus sign (+) that appears, and select **Add an action**.
64
64
65
-
1. In the search box, enter **Microsoft graph security** as your filter. From the actions list, select the action you want.
65
+
1. In the **Add an action**search box, enter **Microsoft Graph Security** as your filter. From the actions list, select the action you want.
66
66
67
67
1. Sign in with your Microsoft Graph Security credentials.
68
68
69
69
1. Provide the necessary details for your selected action and continue building your logic app's workflow.
70
70
71
71
## Add triggers
72
72
73
-
In Azure Logic Apps, every logic app must start with a [trigger](../logic-apps/logic-apps-overview.md#logic-app-concepts), which fires when a specific event happens or when a specific condition is met. Each time that the trigger fires, the Logic Apps engine creates a logic app instance and starts running your app's workflow.
73
+
In Azure Logic Apps, every logic app must start with a [trigger](../logic-apps/logic-apps-overview.md#logic-app-concepts), which fires when a specific event happens or when a specific condition is met. Each time that the trigger fires, the logic apps engine creates a logic app instance and starts running your app's workflow.
74
74
75
75
> [!NOTE]
76
76
> When a trigger fires, the trigger processes all the new alerts. If no alerts are received, the trigger run is skipped. The next trigger poll happens based on the recurrence interval that you specify in the trigger's properties.
77
77
78
-
This example shows how you can start a logic app workflow when new alerts are sent to your app.
78
+
The following example shows how you can start a logic app workflow when new alerts are sent to your app:
79
79
80
-
1. In the Azure portal, create a blank logic app, which opens the Logic App Designer. This example uses the Azure portal.
80
+
1. In the Azure portal, create a blank logic app, which opens the Logic App Designer.
81
81
82
-
1. Select **Add a trigger** on the designer canvas. In the **Add a trigger** search box, enter **Microsoft Graph Security** as your filter. From the triggers list, select this trigger: **On all new alerts**
82
+
1. Select **Add a trigger** on the designer canvas. In the **Add a trigger** search box, enter **Microsoft Graph Security** as your filter. From the triggers list, select this trigger: **On all new alerts**.
83
83
84
-
1. In the trigger, provide information about the alerts that you want to monitor. For more properties, open the **Add new parameter** list, and select a parameter to add that property to the trigger.
84
+
1. In the trigger, provide information about the alerts that you want to monitor.
|**Interval**|`interval`| Yes | Integer | A positive integer that describes how often the workflow runs, based on the frequency unit of time. Allowable intervals: <p><p>- **Second**: 1-9,999,999 seconds <br>- **Minute**: 1-72,000 minutes <br>- **Hour**: 1-12,000 hours<br>- **Day**: 1-500 days <br>- **Month**: 1-16 months <p>For example, if the interval is 6, and the frequency is **Month**, then the recurrence is every six months. |
89
-
|**Frequency**|`frequency`| Yes | String | The unit of time for the recurrence: **Second**, **Minute**, **Hour**, **Day**, **Week**, or **Month**|
88
+
|**Interval**|`interval`| Yes | Integer | A positive integer that describes how often the workflow runs, based on the frequency unit of time. Allowable intervals: <p><p>- **Month**: 1-16 months<br>- **Week**: 1-71 weeks<br>- **Day**: 1-500 days<br>- **Hour**: 1-12,000 hours<br>- **Minute**: 1-72,000 minutes<br>- **Second**: 1-9,999,999 seconds<p>For example, if the interval is 6, and the frequency is **Month**, then the recurrence is every 6 months. |
89
+
|**Frequency**|`frequency`| Yes | String | The unit of time for the recurrence: **Month**, **Week**, **Day**, **Hour**, **Minute**, or **Second**.|
90
90
|**Time zone**|`timeZone`| No | String | Select the time zone that you want to apply. Because this trigger doesn't accept [UTC offset](https://en.wikipedia.org/wiki/UTC_offset), it applies only when you specify a start time. |
91
-
| **Start time** | `startTime` | No | String | Provide a start date and time in this format: <p><p>- If you select a time zone: YYYY-MM-DDThh:mm:ss<p>- If you don't select a time zone: YYYY-MM-DDThh:mm:ssZ<p>For example, for September 18, 2017 at 2:00 PM, enter **2017-09-18T14:00:00** and select a time zone such as **Pacific Standard Time**. Or, enter **2017-09-18T14:00:00Z** without specifying a time zone. <p>This start time has a maximum of 49 years in the future and must follow the [ISO 8601 date time specification](https://en.wikipedia.org/wiki/ISO_8601#Combined_date_and_time_representations) in [UTC date time format](https://en.wikipedia.org/wiki/Coordinated_Universal_Time), but without a [UTC offset](https://en.wikipedia.org/wiki/UTC_offset). If you don't select a time zone, you must add the letter **Z** at the end of the specified time without any spaces. **Z** refers to the equivalent [nautical time](https://en.wikipedia.org/wiki/Nautical_time). <p>For simple schedules, the start time is the first occurrence, while for complex schedules, the trigger doesn't fire any sooner than the start time. For more information, see [Patterns for start date and time](../logic-apps/concepts-schedule-automated-recurring-tasks-workflows.md#start-time) |
91
+
| **Start time** | `startTime` | No | String | Provide a start date and time in this format: <p><p>- If you select a time zone: YYYY-MM-DDThh:mm:ss<p>- If you don't select a time zone: YYYY-MM-DDThh:mm:ssZ<p>For example, for September 18, 2017 at 2:00 PM, enter **2017-09-18T14:00:00** and select a time zone such as **(UTC-08:00) Pacific Time (US & Canada)**. Or, enter **2017-09-18T14:00:00Z** without specifying a time zone. <p>The start time has a maximum of 49 years in the future and must follow the [ISO 8601 date time specification](https://en.wikipedia.org/wiki/ISO_8601#Combined_date_and_time_representations) in [UTC date time format](https://en.wikipedia.org/wiki/Coordinated_Universal_Time), but without a [UTC offset](https://en.wikipedia.org/wiki/UTC_offset). If you don't select a time zone, you must add the letter **Z** at the end of the specified time without any spaces. **Z** refers to the equivalent [nautical time](https://en.wikipedia.org/wiki/Nautical_time). <p>For simple schedules, the start time is the first occurrence. For complex schedules, the trigger doesn't fire any sooner than the start time. For more information, see [Patterns for start date and time](../logic-apps/concepts-schedule-automated-recurring-tasks-workflows.md#start-time). |
92
92
93
93
1. When you're done, on the designer toolbar, select **Save**.
94
94
95
95
1. Add one or more actions to your logic app for the tasks you want to perform with the trigger results.
96
96
97
97
## Add actions
98
98
99
-
Here are more specific details about using the various actions available with the Microsoft Graph Security connector.
99
+
With the Microsoft Graph Security connector, you can add actions to manage alerts, alert subscriptions, and threat intelligence indicators.
100
100
101
101
### Manage alerts
102
102
@@ -108,6 +108,8 @@ The following example shows the parameters for a **Get alerts** action when you
108
108
109
109
For more information about the queries you can use with this connector, see the [Microsoft Graph Security alerts reference](/graph/api/alert-list). To build enhanced experiences with this connector, learn about the [schema properties alerts](/graph/api/resources/alert) that the connector supports.
110
110
111
+
The following table lists supported alert actions.
112
+
111
113
| Action | Description |
112
114
| ------ | ----------- |
113
115
|**Get alerts**| Get alerts filtered based on one or more [alert properties](/graph/api/resources/alert), for example, `Provider eq 'Azure Security Center' or 'Palo Alto Networks'`. |
@@ -116,14 +118,18 @@ For more information about the queries you can use with this connector, see the
116
118
117
119
### Manage alert subscriptions
118
120
119
-
Microsoft Graph supports [*subscriptions*](/graph/api/resources/subscription), or [*webhooks*](/graph/api/resources/change-notifications-api-overview?view=graph-rest-1.0). To get, update, or delete subscriptions, provide the [ODATA query parameters supported by Microsoft Graph](/graph/query-parameters) to the Microsoft Graph entity construct and include `security/alerts` followed by the ODATA query. Don't include the base URL, for example, `https://graph.microsoft.com/v1.0`. Instead, use the format in this example:
121
+
Microsoft Graph supports [*subscriptions*](/graph/api/resources/subscription), or [*webhooks*](/graph/api/resources/change-notifications-api-overview). To get, update, or delete subscriptions, provide the [ODATA query parameters supported by Microsoft Graph](/graph/query-parameters) to the Microsoft Graph entity construct and include `security/alerts` followed by the ODATA query.
122
+
123
+
Don't include the base URL, for example, `https://graph.microsoft.com/v1.0`. Instead, use the format in the following example:
120
124
121
125
`security/alerts?$filter=status eq 'NewAlert'`
122
126
127
+
The following table lists supported alert subscription actions.
128
+
123
129
| Action | Description |
124
130
| ------ | ----------- |
125
131
|**Create subscriptions**|[Create a subscription](/graph/api/subscription-post-subscriptions) that notifies you about any changes. You can filter this subscription for the specific alert types you want. For example, you can create a subscription that notifies you about high severity alerts. |
126
-
|**Get active subscriptions**|[List active, unexpired subscriptions](/graph/api/subscription-list). |
132
+
|**Get active subscriptions**|Get a [subscription list](/graph/api/subscription-list) that shows active and unexpired subscriptions. |
127
133
|**Update subscription**|[Update a subscription](/graph/api/subscription-update) by providing the subscription ID. For example, to extend your subscription, you can update the subscription's `expirationDateTime` property. |
128
134
|**Delete subscription**|[Delete a subscription](/graph/api/subscription-delete) by providing the subscription ID. |
129
135
@@ -135,9 +141,11 @@ To filter, sort, or get the most recent results, provide *only* the [ODATA query
135
141
136
142
For more information about the queries that you can use with this connector, see [Optional query parameters](/graph/api/tiindicators-list#optional-query-parameters). To build enhanced experiences with this connector, learn about the [schema properties threat intelligence indicator](/graph/api/resources/tiindicator) that the connector supports.
137
143
144
+
The following table lists supported threat intelligence indicator actions.
145
+
138
146
| Action | Description |
139
147
| ------ | ----------- |
140
-
|**Get threat intelligence indicators**| Get tiIndicators filtered based on one or more [tiIndicator properties](/graph/api/resources/tiindicator), for example, `threatType eq 'MaliciousUrl' or 'DDoS'`|
148
+
|**Get threat intelligence indicators**| Get tiIndicators filtered based on one or more [tiIndicator properties](/graph/api/resources/tiindicator), for example, `threatType eq 'MaliciousUrl' or 'DDoS'`.|
141
149
|**Get threat intelligence indicator by ID**| Get a specific tiIndicator based on the tiIndicator ID. |
142
150
|**Create threat intelligence indicator**| Create a new tiIndicator by posting to the tiIndicators collection. To make sure that you pass the required properties in your request, refer to the [required properties for creating tiIndicator](/graph/api/tiindicators-post). |
143
151
|**Submit multiple threat intelligence indicators**| Create multiple new tiIndicators by posting a tiIndicators collection. To make sure that you pass the required properties in your request, refer to the [required properties for submitting multiple tiIndicators](/graph/api/tiindicator-submittiindicators). |
0 commit comments