diff --git a/Solutions/SilentPush/.gitignore b/Solutions/SilentPush/.gitignore new file mode 100644 index 00000000000..5a5526b1408 --- /dev/null +++ b/Solutions/SilentPush/.gitignore @@ -0,0 +1,4 @@ +CLAUDE.md +_docs +../../Tools/Create-Azure-Sentinel-Solution/input/Solution_SilentPush.json +.claude/ \ No newline at end of file diff --git a/Solutions/SilentPush/Connector/SilentPushCustomConnector/azuredeploy.json b/Solutions/SilentPush/Connector/SilentPushCustomConnector/azuredeploy.json index 74d2b599edc..11794a4e4bc 100644 --- a/Solutions/SilentPush/Connector/SilentPushCustomConnector/azuredeploy.json +++ b/Solutions/SilentPush/Connector/SilentPushCustomConnector/azuredeploy.json @@ -8,15 +8,11 @@ "metadata": { "description": "The Silent Push API" } - }, - "userAgent": { - "type": "string", - "defaultValue": "Microsoft/Sentinel (Playbook)", - "metadata": { - "description": "User-Agent header value sent with every Silent Push API request." - } } }, + "variables": { + "userAgent": "Microsoft/Sentinel (Playbook)" + }, "resources": [ { "type": "Microsoft.Web/customApis", @@ -88,7 +84,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -152,7 +148,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -195,7 +191,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -242,7 +238,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -306,7 +302,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -353,7 +349,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -417,7 +413,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -467,7 +463,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -620,7 +616,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -829,7 +825,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -884,7 +880,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -939,7 +935,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -1022,7 +1018,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -1077,7 +1073,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -1160,7 +1156,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -1236,7 +1232,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -1284,7 +1280,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -1409,7 +1405,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -1527,7 +1523,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -1589,7 +1585,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -1630,7 +1626,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -1678,7 +1674,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -1775,7 +1771,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -1823,7 +1819,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -2039,7 +2035,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -2262,7 +2258,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -2380,7 +2376,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -2491,7 +2487,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -2588,7 +2584,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -2958,7 +2954,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -3153,7 +3149,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -3278,7 +3274,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -3536,7 +3532,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -3738,7 +3734,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -3807,7 +3803,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -3850,7 +3846,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -3917,7 +3913,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -3970,7 +3966,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -4022,7 +4018,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -4065,7 +4061,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -4109,7 +4105,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -4168,7 +4164,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -4228,7 +4224,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -4277,7 +4273,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -4339,7 +4335,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -4426,7 +4422,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -4465,7 +4461,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -4537,7 +4533,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -4611,7 +4607,7 @@ "in": "header", "required": true, "type": "string", - "default": "[parameters('userAgent')]", + "default": "[variables('userAgent')]", "x-ms-visibility": "internal" } ], diff --git a/Solutions/SilentPush/Connector/SilentPushCustomConnector/readme.md b/Solutions/SilentPush/Connector/SilentPushCustomConnector/readme.md new file mode 100644 index 00000000000..5b550c992b6 --- /dev/null +++ b/Solutions/SilentPush/Connector/SilentPushCustomConnector/readme.md @@ -0,0 +1,18 @@ +# Silent Push Logic Apps custom connector + +This custom connector (`SilentPush-API`) connects Azure Logic Apps to the [Silent Push](https://www.silentpush.com) public API. It exposes nearly all Silent Push API endpoints (enrichment, passive DNS explore and search, exports, feeds, live scan, SPQL and threat check), so you can build your own playbooks from scratch. + +All Silent Push playbooks in this solution use this connector, so **deploy it first**. + +### Authentication + +API key. You are asked for your Silent Push API key when you create a connection. Sign up at https://app.silentpush.com to get one. + +### Deployment instructions + +1. Click **Deploy to Azure**. This opens the ARM template deployment wizard. +2. Pick the subscription and the resource group where your playbooks will live (the same resource group as the playbooks). +3. Fill in the parameters: + * **CustomConnectorName**: name of the connector (default `SilentPush-API`). If you change it, use the same value for `CustomConnectorName` when deploying the playbooks. + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FSilentPush%2FConnector%2FSilentPushCustomConnector%2Fazuredeploy.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FSilentPush%2FConnector%2FSilentPushCustomConnector%2Fazuredeploy.json) diff --git a/Solutions/SilentPush/Data/Solution_SilentPush.json b/Solutions/SilentPush/Data/Solution_SilentPush.json index 5b975dc6b60..80143b4c48b 100644 --- a/Solutions/SilentPush/Data/Solution_SilentPush.json +++ b/Solutions/SilentPush/Data/Solution_SilentPush.json @@ -18,7 +18,7 @@ "Playbooks/SilentPush-DomainExportEnrichment-Full/azuredeploy.json" ], "Metadata": "SolutionMetadata.json", - "Version": "3.1.0", + "Version": "3.2.0", "TemplateSpec": true, "Is1Pconnector": false } diff --git a/Solutions/SilentPush/Package/3.2.0.zip b/Solutions/SilentPush/Package/3.2.0.zip new file mode 100644 index 00000000000..e21b17ce321 Binary files /dev/null and b/Solutions/SilentPush/Package/3.2.0.zip differ diff --git a/Solutions/SilentPush/Package/createUiDefinition.json b/Solutions/SilentPush/Package/createUiDefinition.json index 094cb71525e..050b836b7ca 100644 --- a/Solutions/SilentPush/Package/createUiDefinition.json +++ b/Solutions/SilentPush/Package/createUiDefinition.json @@ -69,7 +69,7 @@ "options": { "link": { "label": "Learn more about connecting data sources", - "uri": "https://learn.microsoft.com/azure/sentinel/connect-data-sources" + "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources" } } } @@ -97,7 +97,7 @@ "options": { "link": { "label": "Learn more", - "uri": "https://learn.microsoft.com/azure/sentinel/tutorial-respond-threats-playbook?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef" + "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-respond-threats-playbook?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef" } } } diff --git a/Solutions/SilentPush/Package/mainTemplate.json b/Solutions/SilentPush/Package/mainTemplate.json index 6d0d790980b..cf196df3849 100644 --- a/Solutions/SilentPush/Package/mainTemplate.json +++ b/Solutions/SilentPush/Package/mainTemplate.json @@ -47,11 +47,11 @@ "email": "support@silentpush.com", "_email": "[variables('email')]", "_solutionName": "SilentPush", - "_solutionVersion": "3.1.0", + "_solutionVersion": "3.0.0", "solutionId": "silentpushinc1618175309468.azure-sentinel-solution-silentpush", "_solutionId": "[variables('solutionId')]", "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", - "dataConnectorCCPVersion": "3.1.0", + "dataConnectorCCPVersion": "3.0.0", "_dataConnectorContentIdConnectorDefinition1": "SilentPushFeedsConnectorDefinition", "dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]", "_dataConnectorContentIdConnections1": "SilentPushFeedsConnectorDefinitionConnections", @@ -69,7 +69,7 @@ "_playbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','lc','-', uniqueString(concat(variables('_solutionId'),'-','LogicAppsCustomConnector','-',variables('_playbookContentId1'),'-', variables('playbookVersion1'))))]", "SilentPush-IPExportEnrichment-Sample": "SilentPush-IPExportEnrichment-Sample", "_SilentPush-IPExportEnrichment-Sample": "[variables('SilentPush-IPExportEnrichment-Sample')]", - "playbookVersion2": "1.0", + "playbookVersion2": "1.2", "playbookContentId2": "SilentPush-IPExportEnrichment-Sample", "_playbookContentId2": "[variables('playbookContentId2')]", "playbookId2": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId2'))]", @@ -77,7 +77,7 @@ "_playbookcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId2'),'-', variables('playbookVersion2'))))]", "SilentPush-IPExportEnrichment-Full": "SilentPush-IPExportEnrichment-Full", "_SilentPush-IPExportEnrichment-Full": "[variables('SilentPush-IPExportEnrichment-Full')]", - "playbookVersion3": "1.0", + "playbookVersion3": "1.4", "playbookContentId3": "SilentPush-IPExportEnrichment-Full", "_playbookContentId3": "[variables('playbookContentId3')]", "playbookId3": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId3'))]", @@ -85,7 +85,7 @@ "_playbookcontentProductId3": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId3'),'-', variables('playbookVersion3'))))]", "SilentPush-DomainExportEnrichment-Sample": "SilentPush-DomainExportEnrichment-Sample", "_SilentPush-DomainExportEnrichment-Sample": "[variables('SilentPush-DomainExportEnrichment-Sample')]", - "playbookVersion4": "1.0", + "playbookVersion4": "1.2", "playbookContentId4": "SilentPush-DomainExportEnrichment-Sample", "_playbookContentId4": "[variables('playbookContentId4')]", "playbookId4": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId4'))]", @@ -93,7 +93,7 @@ "_playbookcontentProductId4": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId4'),'-', variables('playbookVersion4'))))]", "SilentPush-DomainExportEnrichment-Full": "SilentPush-DomainExportEnrichment-Full", "_SilentPush-DomainExportEnrichment-Full": "[variables('SilentPush-DomainExportEnrichment-Full')]", - "playbookVersion5": "1.0", + "playbookVersion5": "1.4", "playbookContentId5": "SilentPush-DomainExportEnrichment-Full", "_playbookContentId5": "[variables('playbookContentId5')]", "playbookId5": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId5'))]", @@ -1226,7 +1226,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SilentPushCustomConnector Playbook with template version 3.1.0", + "description": "SilentPushCustomConnector Playbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -1237,16 +1237,108 @@ "metadata": { "description": "The Silent Push API" } - }, - "userAgent": { - "type": "string", - "defaultValue": "Microsoft/Sentinel (Playbook)", - "metadata": { - "description": "User-Agent header value sent with every Silent Push API request." - } } }, "variables": { + "userAgent": "Microsoft/Sentinel (Playbook)", + "operationId-v1_enrich_domain_bulk_create": "v1_enrich_domain_bulk_create", + "_operationId-v1_enrich_domain_bulk_create": "[[variables('operationId-v1_enrich_domain_bulk_create')]", + "operationId-v1_enrich_domain_list": "v1_enrich_domain_list", + "_operationId-v1_enrich_domain_list": "[[variables('operationId-v1_enrich_domain_list')]", + "operationId-v1_enrich_domain_ip_diversity_retrieve": "v1_enrich_domain_ip_diversity_retrieve", + "_operationId-v1_enrich_domain_ip_diversity_retrieve": "[[variables('operationId-v1_enrich_domain_ip_diversity_retrieve')]", + "operationId-v1_enrich_ipv4_bulk_create": "v1_enrich_ipv4_bulk_create", + "_operationId-v1_enrich_ipv4_bulk_create": "[[variables('operationId-v1_enrich_ipv4_bulk_create')]", + "operationId-v1_enrich_ipv4_list": "v1_enrich_ipv4_list", + "_operationId-v1_enrich_ipv4_list": "[[variables('operationId-v1_enrich_ipv4_list')]", + "operationId-v1_enrich_ipv6_bulk_create": "v1_enrich_ipv6_bulk_create", + "_operationId-v1_enrich_ipv6_bulk_create": "[[variables('operationId-v1_enrich_ipv6_bulk_create')]", + "operationId-v1_enrich_ipv6_list": "v1_enrich_ipv6_list", + "_operationId-v1_enrich_ipv6_list": "[[variables('operationId-v1_enrich_ipv6_list')]", + "operationId-v1_explore_padns_bulk_lookup_density_create": "v1_explore_padns_bulk_lookup_density_create", + "_operationId-v1_explore_padns_bulk_lookup_density_create": "[[variables('operationId-v1_explore_padns_bulk_lookup_density_create')]", + "operationId-v1_explore_padns_lookup_answer_list": "v1_explore_padns_lookup_answer_list", + "_operationId-v1_explore_padns_lookup_answer_list": "[[variables('operationId-v1_explore_padns_lookup_answer_list')]", + "operationId-v1_explore_padns_lookup_both_list": "v1_explore_padns_lookup_both_list", + "_operationId-v1_explore_padns_lookup_both_list": "[[variables('operationId-v1_explore_padns_lookup_both_list')]", + "operationId-v1_explore_padns_lookup_contextsimilarity_list": "v1_explore_padns_lookup_contextsimilarity_list", + "_operationId-v1_explore_padns_lookup_contextsimilarity_list": "[[variables('operationId-v1_explore_padns_lookup_contextsimilarity_list')]", + "operationId-v1_explore_padns_lookup_density_list": "v1_explore_padns_lookup_density_list", + "_operationId-v1_explore_padns_lookup_density_list": "[[variables('operationId-v1_explore_padns_lookup_density_list')]", + "operationId-v1_explore_padns_lookup_domain_asns_list": "v1_explore_padns_lookup_domain_asns_list", + "_operationId-v1_explore_padns_lookup_domain_asns_list": "[[variables('operationId-v1_explore_padns_lookup_domain_asns_list')]", + "operationId-v1_explore_padns_lookup_hostdiversity_list": "v1_explore_padns_lookup_hostdiversity_list", + "_operationId-v1_explore_padns_lookup_hostdiversity_list": "[[variables('operationId-v1_explore_padns_lookup_hostdiversity_list')]", + "operationId-v1_explore_padns_lookup_ipdiversity_list": "v1_explore_padns_lookup_ipdiversity_list", + "_operationId-v1_explore_padns_lookup_ipdiversity_list": "[[variables('operationId-v1_explore_padns_lookup_ipdiversity_list')]", + "operationId-v1_explore_padns_lookup_newrecords_list": "v1_explore_padns_lookup_newrecords_list", + "_operationId-v1_explore_padns_lookup_newrecords_list": "[[variables('operationId-v1_explore_padns_lookup_newrecords_list')]", + "operationId-v1_explore_padns_lookup_probestatus_list": "v1_explore_padns_lookup_probestatus_list", + "_operationId-v1_explore_padns_lookup_probestatus_list": "[[variables('operationId-v1_explore_padns_lookup_probestatus_list')]", + "operationId-v1_explore_padns_lookup_query_autospoof_list": "v1_explore_padns_lookup_query_autospoof_list", + "_operationId-v1_explore_padns_lookup_query_autospoof_list": "[[variables('operationId-v1_explore_padns_lookup_query_autospoof_list')]", + "operationId-v1_explore_padns_lookup_query_changeprofile_list": "v1_explore_padns_lookup_query_changeprofile_list", + "_operationId-v1_explore_padns_lookup_query_changeprofile_list": "[[variables('operationId-v1_explore_padns_lookup_query_changeprofile_list')]", + "operationId-v1_explore_padns_lookup_report_danglers_list": "v1_explore_padns_lookup_report_danglers_list", + "_operationId-v1_explore_padns_lookup_report_danglers_list": "[[variables('operationId-v1_explore_padns_lookup_report_danglers_list')]", + "operationId-v1_explore_padns_lookup_report_danglerscount_list": "v1_explore_padns_lookup_report_danglerscount_list", + "_operationId-v1_explore_padns_lookup_report_danglerscount_list": "[[variables('operationId-v1_explore_padns_lookup_report_danglerscount_list')]", + "operationId-v1_explore_padns_lookup_resolvedates_list": "v1_explore_padns_lookup_resolvedates_list", + "_operationId-v1_explore_padns_lookup_resolvedates_list": "[[variables('operationId-v1_explore_padns_lookup_resolvedates_list')]", + "operationId-v1_explore_padns_lookup_subdomains_list": "v1_explore_padns_lookup_subdomains_list", + "_operationId-v1_explore_padns_lookup_subdomains_list": "[[variables('operationId-v1_explore_padns_lookup_subdomains_list')]", + "operationId-v1_explore_padns_lookup_translate_list": "v1_explore_padns_lookup_translate_list", + "_operationId-v1_explore_padns_lookup_translate_list": "[[variables('operationId-v1_explore_padns_lookup_translate_list')]", + "operationId-v1_explore_padns_lookup_uld_autospoof_list": "v1_explore_padns_lookup_uld_autospoof_list", + "_operationId-v1_explore_padns_lookup_uld_autospoof_list": "[[variables('operationId-v1_explore_padns_lookup_uld_autospoof_list')]", + "operationId-v1_explore_padns_lookup_uld_list": "v1_explore_padns_lookup_uld_list", + "_operationId-v1_explore_padns_lookup_uld_list": "[[variables('operationId-v1_explore_padns_lookup_uld_list')]", + "operationId-v1_explore_padns_lookup_wildcard_list": "v1_explore_padns_lookup_wildcard_list", + "_operationId-v1_explore_padns_lookup_wildcard_list": "[[variables('operationId-v1_explore_padns_lookup_wildcard_list')]", + "operationId-v1_explore_padns_search_danglers_list": "v1_explore_padns_search_danglers_list", + "_operationId-v1_explore_padns_search_danglers_list": "[[variables('operationId-v1_explore_padns_search_danglers_list')]", + "operationId-v1_explore_padns_search_domainstring_list": "v1_explore_padns_search_domainstring_list", + "_operationId-v1_explore_padns_search_domainstring_list": "[[variables('operationId-v1_explore_padns_search_domainstring_list')]", + "operationId-v1_explore_padns_search_ipdiversity_list": "v1_explore_padns_search_ipdiversity_list", + "_operationId-v1_explore_padns_search_ipdiversity_list": "[[variables('operationId-v1_explore_padns_search_ipdiversity_list')]", + "operationId-v1_explore_padns_search_namechain_cname_list": "v1_explore_padns_search_namechain_cname_list", + "_operationId-v1_explore_padns_search_namechain_cname_list": "[[variables('operationId-v1_explore_padns_search_namechain_cname_list')]", + "operationId-v1_explore_padns_search_selfhosted_ns_list": "v1_explore_padns_search_selfhosted_ns_list", + "_operationId-v1_explore_padns_search_selfhosted_ns_list": "[[variables('operationId-v1_explore_padns_search_selfhosted_ns_list')]", + "operationId-v1_explore_padns_search_soa_list": "v1_explore_padns_search_soa_list", + "_operationId-v1_explore_padns_search_soa_list": "[[variables('operationId-v1_explore_padns_search_soa_list')]", + "operationId-v1_explore_padns_search_typosquat_list": "v1_explore_padns_search_typosquat_list", + "_operationId-v1_explore_padns_search_typosquat_list": "[[variables('operationId-v1_explore_padns_search_typosquat_list')]", + "operationId-v1_explore_padns_snapshot_domain_list": "v1_explore_padns_snapshot_domain_list", + "_operationId-v1_explore_padns_snapshot_domain_list": "[[variables('operationId-v1_explore_padns_snapshot_domain_list')]", + "operationId-v1_export_retrieve": "v1_export_retrieve", + "_operationId-v1_export_retrieve": "[[variables('operationId-v1_export_retrieve')]", + "operationId-v1_feeds_indicators_list": "v1_feeds_indicators_list", + "_operationId-v1_feeds_indicators_list": "[[variables('operationId-v1_feeds_indicators_list')]", + "operationId-v1_feeds_indicators_create": "v1_feeds_indicators_create", + "_operationId-v1_feeds_indicators_create": "[[variables('operationId-v1_feeds_indicators_create')]", + "operationId-v1_feeds_indicators_bulk_delete_create": "v1_feeds_indicators_bulk_delete_create", + "_operationId-v1_feeds_indicators_bulk_delete_create": "[[variables('operationId-v1_feeds_indicators_bulk_delete_create')]", + "operationId-v1_feeds_indicators_destroy": "v1_feeds_indicators_destroy", + "_operationId-v1_feeds_indicators_destroy": "[[variables('operationId-v1_feeds_indicators_destroy')]", + "operationId-v1_feeds_indicators_retrieve": "v1_feeds_indicators_retrieve", + "_operationId-v1_feeds_indicators_retrieve": "[[variables('operationId-v1_feeds_indicators_retrieve')]", + "operationId-v1_feeds_indicators_partial_update": "v1_feeds_indicators_partial_update", + "_operationId-v1_feeds_indicators_partial_update": "[[variables('operationId-v1_feeds_indicators_partial_update')]", + "operationId-v1_feeds_indicators_update": "v1_feeds_indicators_update", + "_operationId-v1_feeds_indicators_update": "[[variables('operationId-v1_feeds_indicators_update')]", + "operationId-v1_feeds_indicators_tags_retrieve": "v1_feeds_indicators_tags_retrieve", + "_operationId-v1_feeds_indicators_tags_retrieve": "[[variables('operationId-v1_feeds_indicators_tags_retrieve')]", + "operationId-v1_feeds_indicators_update_tags_update": "v1_feeds_indicators_update_tags_update", + "_operationId-v1_feeds_indicators_update_tags_update": "[[variables('operationId-v1_feeds_indicators_update_tags_update')]", + "operationId-v1_live_scan_list": "v1_live_scan_list", + "_operationId-v1_live_scan_list": "[[variables('operationId-v1_live_scan_list')]", + "operationId-v1_spql_search_create": "v1_spql_search_create", + "_operationId-v1_spql_search_create": "[[variables('operationId-v1_spql_search_create')]", + "operationId-v1_threat_check_retrieve": "v1_threat_check_retrieve", + "_operationId-v1_threat_check_retrieve": "[[variables('operationId-v1_threat_check_retrieve')]", + "operationId-v1_threat_check_bulk_create": "v1_threat_check_bulk_create", + "_operationId-v1_threat_check_bulk_create": "[[variables('operationId-v1_threat_check_bulk_create')]", "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", "playbookContentId1": "SilentPushCustomConnector", "playbookId1": "[[resourceId('Microsoft.Web/customApis', parameters('CustomConnectorName'))]", @@ -1324,7 +1416,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -1388,7 +1480,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -1431,7 +1523,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -1478,7 +1570,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -1542,7 +1634,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -1589,7 +1681,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -1653,7 +1745,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -1703,7 +1795,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -1855,7 +1947,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -2063,7 +2155,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -2117,7 +2209,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -2171,7 +2263,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -2253,7 +2345,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -2307,7 +2399,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -2389,7 +2481,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -2464,7 +2556,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -2511,7 +2603,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -2635,7 +2727,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -2752,7 +2844,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -2813,7 +2905,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -2853,7 +2945,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -2900,7 +2992,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -2996,7 +3088,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -3043,7 +3135,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -3258,7 +3350,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -3480,7 +3572,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -3597,7 +3689,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -3707,7 +3799,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -3803,7 +3895,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -4172,7 +4264,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -4366,7 +4458,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -4490,7 +4582,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -4747,7 +4839,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -4948,7 +5040,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -5016,7 +5108,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -5058,7 +5150,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -5125,7 +5217,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -5178,7 +5270,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -5230,7 +5322,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -5273,7 +5365,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -5317,7 +5409,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -5376,7 +5468,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -5436,7 +5528,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -5485,7 +5577,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -5547,7 +5639,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -5634,7 +5726,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -5673,7 +5765,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -5745,7 +5837,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -5819,7 +5911,7 @@ "in": "header", "required": true, "type": "string", - "default": "[[parameters('userAgent')]", + "default": "[[variables('userAgent')]", "x-ms-visibility": "internal" } ], @@ -6244,7 +6336,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SilentPush-IPExportEnrichment-Sample Playbook with template version 3.1.0", + "description": "SilentPush-IPExportEnrichment-Sample Playbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion2')]", @@ -6266,8 +6358,7 @@ }, "variables": { "SilentPushConnectionName": "[[parameters('PlaybookName')]", - "silentPushApiId": "[[resourceId('Microsoft.Web/customApis', parameters('CustomConnectorName'))]", - "connection-1": "[[resourceId('Microsoft.Web/customApis', parameters('CustomConnectorName'))]", + "connection-1": "[[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/customApis/', parameters('CustomConnectorName'))]", "_connection-1": "[[variables('connection-1')]", "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", "workspace-name": "[parameters('workspace')]", @@ -6293,6 +6384,10 @@ { "name": "[[parameters('PlaybookName')]", "type": "Microsoft.Logic/workflows", + "tags": { + "hidden-SentinelTemplateVersion": "1.2", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, "location": "[[variables('workspace-location-inline')]", "identity": { "type": "SystemAssigned" @@ -6456,9 +6551,6 @@ } } } - }, - "tags": { - "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" } }, { @@ -6484,6 +6576,15 @@ "email": "support@silentpush.com", "tier": "Partner", "link": "https://www.silentpush.com" + }, + "dependencies": { + "criteria": [ + { + "kind": "LogicAppsCustomConnector", + "contentId": "[variables('_SilentPushCustomConnector')]", + "version": "[variables('playbookVersion1')]" + } + ] } } } @@ -6491,6 +6592,10 @@ "metadata": { "title": "SilentPush-IPExportEnrichment-Sample", "description": "Silent Push IPs export with enrichment", + "prerequisites": [ + "1. Deploy the Silent Push custom connector BEFORE creating this playbook. Installing the solution does not create it. Deploy it with the Deploy to Azure button on https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SilentPush/Connector/SilentPushCustomConnector (or deploy its azuredeploy.json as a custom template).", + "2. Deploy the connector into the same resource group where you create this playbook and keep its name as SilentPush-API (or use the same name in the CustomConnectorName parameter)." + ], "postDeployment": [ "**Authorize the SilentPush connector connection**", "This playbook deploys with a placeholder (empty) API key for the SilentPush connector. Complete the connection before enabling/running the playbook:", @@ -6499,9 +6604,9 @@ "3. Enter your Silent Push API key (sign up at https://app.silentpush.com)", "4. Click Save" ], - "lastUpdateTime": "2026-09-28T16:04:31.749Z", + "lastUpdateTime": "2026-10-28T15:27:07.525Z", "releaseNotes": { - "version": "1.0", + "version": "1.2", "title": "[variables('blanks')]", "notes": [ "Initial version" @@ -6531,7 +6636,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SilentPush-IPExportEnrichment-Full Playbook with template version 3.1.0", + "description": "SilentPush-IPExportEnrichment-Full Playbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion3')]", @@ -6550,7 +6655,7 @@ "description": "The SilentPush API custom connector" } }, - "workspace": { + "WorkspaceName": { "type": "string", "metadata": { "description": "Log Analytics workspace name where Microsoft Sentinel is enabled" @@ -6558,17 +6663,16 @@ } }, "variables": { - "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/workspaces', parameters('workspace'))]", + "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/workspaces', parameters('WorkspaceName'))]", "SilentPushConnectionName": "[[parameters('PlaybookName')]", "MicrosoftSentinelConnectionName": "[[concat('azuresentinel-', parameters('PlaybookName'))]", - "silentPushApiId": "[[resourceId('Microsoft.Web/customApis', parameters('CustomConnectorName'))]", "_SentinelContributorRoleGuid": "ab8e14d6-4a74-4a29-9ba8-549422addade", "SentinelContributorRoleId": "[[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('_SentinelContributorRoleGuid'))]", "maxExportSizeChars": "20000000", "batchSizeLines": "100", - "connection-1": "[[resourceId('Microsoft.Web/customApis', parameters('CustomConnectorName'))]", + "connection-1": "[[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/customApis/', parameters('CustomConnectorName'))]", "_connection-1": "[[variables('connection-1')]", - "connection-2": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', reference(resourceId('microsoft.OperationalInsights/workspaces', parameters('workspace')), '2025-07-01', 'Full').location, '/managedApis/azuresentinel')]", + "connection-2": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", "_connection-2": "[[variables('connection-2')]", "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", "workspace-name": "[parameters('workspace')]" @@ -6607,6 +6711,10 @@ { "name": "[[parameters('PlaybookName')]", "type": "Microsoft.Logic/workflows", + "tags": { + "hidden-SentinelTemplateVersion": "1.4", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, "location": "[[variables('workspace-location-inline')]", "identity": { "type": "SystemAssigned" @@ -6865,7 +6973,7 @@ "sourcesystem": "Silent Push - IOFA Export", "indicators": "@body('Build_TI_Indicators')" }, - "path": "[[concat('/V2/ThreatIntelligence/', reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), '2025-07-01').customerId, '/UploadIndicators/')]", + "path": "[[concat('/V2/ThreatIntelligence/', reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('WorkspaceName')), '2025-07-01').customerId, '/UploadIndicators/')]", "retryPolicy": { "type": "exponential", "count": 10, @@ -6938,7 +7046,7 @@ "azuresentinel": { "connectionId": "[[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]", "connectionName": "[[variables('MicrosoftSentinelConnectionName')]", - "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', reference(resourceId('microsoft.OperationalInsights/workspaces', parameters('workspace')), '2025-07-01', 'Full').location, '/managedApis/azuresentinel')]", + "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", "connectionProperties": { "authentication": { "type": "ManagedServiceIdentity" @@ -6948,9 +7056,6 @@ } } } - }, - "tags": { - "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" } }, { @@ -6990,6 +7095,15 @@ "email": "support@silentpush.com", "tier": "Partner", "link": "https://www.silentpush.com" + }, + "dependencies": { + "criteria": [ + { + "kind": "LogicAppsCustomConnector", + "contentId": "[variables('_SilentPushCustomConnector')]", + "version": "[variables('playbookVersion1')]" + } + ] } } } @@ -6997,6 +7111,10 @@ "metadata": { "title": "SilentPush-IPExportEnrichment-Full", "description": "Silent Push IPs export with enrichment and TI upload", + "prerequisites": [ + "1. Deploy the Silent Push custom connector BEFORE creating this playbook. Installing the solution does not create it. Deploy it with the Deploy to Azure button on https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SilentPush/Connector/SilentPushCustomConnector (or deploy its azuredeploy.json as a custom template).", + "2. Deploy the connector into the same resource group where you create this playbook and keep its name as SilentPush-API (or use the same name in the CustomConnectorName parameter)." + ], "postDeployment": [ "**Authorize the SilentPush connector connection**", "This playbook deploys with a placeholder (empty) API key for the SilentPush connector. Complete the connection before enabling/running the playbook:", @@ -7005,9 +7123,9 @@ "3. Enter your Silent Push API key (sign up at https://app.silentpush.com)", "4. Click Save" ], - "lastUpdateTime": "2026-09-28T16:04:33.641Z", + "lastUpdateTime": "2026-10-28T15:27:08.642Z", "releaseNotes": { - "version": "1.0", + "version": "1.4", "title": "[variables('blanks')]", "notes": [ "Initial version" @@ -7037,7 +7155,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SilentPush-DomainExportEnrichment-Sample Playbook with template version 3.1.0", + "description": "SilentPush-DomainExportEnrichment-Sample Playbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion4')]", @@ -7059,8 +7177,7 @@ }, "variables": { "SilentPushConnectionName": "[[parameters('PlaybookName')]", - "silentPushApiId": "[[resourceId('Microsoft.Web/customApis', parameters('CustomConnectorName'))]", - "connection-1": "[[resourceId('Microsoft.Web/customApis', parameters('CustomConnectorName'))]", + "connection-1": "[[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/customApis/', parameters('CustomConnectorName'))]", "_connection-1": "[[variables('connection-1')]", "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", "workspace-name": "[parameters('workspace')]", @@ -7086,6 +7203,10 @@ { "name": "[[parameters('PlaybookName')]", "type": "Microsoft.Logic/workflows", + "tags": { + "hidden-SentinelTemplateVersion": "1.2", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, "location": "[[variables('workspace-location-inline')]", "identity": { "type": "SystemAssigned" @@ -7249,9 +7370,6 @@ } } } - }, - "tags": { - "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" } }, { @@ -7277,6 +7395,15 @@ "email": "support@silentpush.com", "tier": "Partner", "link": "https://www.silentpush.com" + }, + "dependencies": { + "criteria": [ + { + "kind": "LogicAppsCustomConnector", + "contentId": "[variables('_SilentPushCustomConnector')]", + "version": "[variables('playbookVersion1')]" + } + ] } } } @@ -7284,6 +7411,10 @@ "metadata": { "title": "SilentPush-DomainExportEnrichment-Sample", "description": "Silent Push domains export with enrichment", + "prerequisites": [ + "1. Deploy the Silent Push custom connector BEFORE creating this playbook. Installing the solution does not create it. Deploy it with the Deploy to Azure button on https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SilentPush/Connector/SilentPushCustomConnector (or deploy its azuredeploy.json as a custom template).", + "2. Deploy the connector into the same resource group where you create this playbook and keep its name as SilentPush-API (or use the same name in the CustomConnectorName parameter)." + ], "postDeployment": [ "**Authorize the SilentPush connector connection**", "This playbook deploys with a placeholder (empty) API key for the SilentPush connector. Complete the connection before enabling/running the playbook:", @@ -7292,9 +7423,9 @@ "3. Enter your Silent Push API key (sign up at https://app.silentpush.com)", "4. Click Save" ], - "lastUpdateTime": "2026-09-28T16:04:34.124Z", + "lastUpdateTime": "2026-10-28T15:27:08.906Z", "releaseNotes": { - "version": "1.0", + "version": "1.2", "title": "[variables('blanks')]", "notes": [ "Initial version" @@ -7324,7 +7455,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SilentPush-DomainExportEnrichment-Full Playbook with template version 3.1.0", + "description": "SilentPush-DomainExportEnrichment-Full Playbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion5')]", @@ -7343,7 +7474,7 @@ "description": "The SilentPush API custom connector" } }, - "workspace": { + "WorkspaceName": { "type": "string", "metadata": { "description": "Log Analytics workspace name where Microsoft Sentinel is enabled" @@ -7351,17 +7482,16 @@ } }, "variables": { - "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/workspaces', parameters('workspace'))]", + "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/workspaces', parameters('WorkspaceName'))]", "SilentPushConnectionName": "[[parameters('PlaybookName')]", "MicrosoftSentinelConnectionName": "[[concat('azuresentinel-', parameters('PlaybookName'))]", - "silentPushApiId": "[[resourceId('Microsoft.Web/customApis', parameters('CustomConnectorName'))]", "_SentinelContributorRoleGuid": "ab8e14d6-4a74-4a29-9ba8-549422addade", "SentinelContributorRoleId": "[[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('_SentinelContributorRoleGuid'))]", "maxExportSizeChars": "20000000", "batchSizeLines": "100", - "connection-1": "[[resourceId('Microsoft.Web/customApis', parameters('CustomConnectorName'))]", + "connection-1": "[[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/customApis/', parameters('CustomConnectorName'))]", "_connection-1": "[[variables('connection-1')]", - "connection-2": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', reference(resourceId('microsoft.OperationalInsights/workspaces', parameters('workspace')), '2025-07-01', 'Full').location, '/managedApis/azuresentinel')]", + "connection-2": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", "_connection-2": "[[variables('connection-2')]", "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", "workspace-name": "[parameters('workspace')]" @@ -7400,6 +7530,10 @@ { "name": "[[parameters('PlaybookName')]", "type": "Microsoft.Logic/workflows", + "tags": { + "hidden-SentinelTemplateVersion": "1.4", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, "location": "[[variables('workspace-location-inline')]", "identity": { "type": "SystemAssigned" @@ -7641,7 +7775,7 @@ "sourcesystem": "Silent Push - IOFA Export", "indicators": "@body('Build_TI_Indicators')" }, - "path": "[[concat('/V2/ThreatIntelligence/', reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), '2025-07-01').customerId, '/UploadIndicators/')]", + "path": "[[concat('/V2/ThreatIntelligence/', reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('WorkspaceName')), '2025-07-01').customerId, '/UploadIndicators/')]", "retryPolicy": { "type": "exponential", "count": 10, @@ -7714,7 +7848,7 @@ "azuresentinel": { "connectionId": "[[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]", "connectionName": "[[variables('MicrosoftSentinelConnectionName')]", - "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', reference(resourceId('microsoft.OperationalInsights/workspaces', parameters('workspace')), '2025-07-01', 'Full').location, '/managedApis/azuresentinel')]", + "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", "connectionProperties": { "authentication": { "type": "ManagedServiceIdentity" @@ -7724,9 +7858,6 @@ } } } - }, - "tags": { - "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" } }, { @@ -7766,6 +7897,15 @@ "email": "support@silentpush.com", "tier": "Partner", "link": "https://www.silentpush.com" + }, + "dependencies": { + "criteria": [ + { + "kind": "LogicAppsCustomConnector", + "contentId": "[variables('_SilentPushCustomConnector')]", + "version": "[variables('playbookVersion1')]" + } + ] } } } @@ -7773,6 +7913,10 @@ "metadata": { "title": "SilentPush-DomainExportEnrichment-Full", "description": "Silent Push domains export with enrichment and TI upload", + "prerequisites": [ + "1. Deploy the Silent Push custom connector BEFORE creating this playbook. Installing the solution does not create it. Deploy it with the Deploy to Azure button on https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SilentPush/Connector/SilentPushCustomConnector (or deploy its azuredeploy.json as a custom template).", + "2. Deploy the connector into the same resource group where you create this playbook and keep its name as SilentPush-API (or use the same name in the CustomConnectorName parameter)." + ], "postDeployment": [ "**Authorize the SilentPush connector connection**", "This playbook deploys with a placeholder (empty) API key for the SilentPush connector. Complete the connection before enabling/running the playbook:", @@ -7781,9 +7925,9 @@ "3. Enter your Silent Push API key (sign up at https://app.silentpush.com)", "4. Click Save" ], - "lastUpdateTime": "2026-09-28T16:04:35.469Z", + "lastUpdateTime": "2026-10-28T15:27:09.791Z", "releaseNotes": { - "version": "1.0", + "version": "1.4", "title": "[variables('blanks')]", "notes": [ "Initial version" @@ -7809,7 +7953,7 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.1.0", + "version": "3.0.0", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "SilentPush", diff --git a/Solutions/SilentPush/Playbooks/SilentPush-DomainExportEnrichment-Full/azuredeploy.json b/Solutions/SilentPush/Playbooks/SilentPush-DomainExportEnrichment-Full/azuredeploy.json index 3ee2d445460..da8045ed7bf 100644 --- a/Solutions/SilentPush/Playbooks/SilentPush-DomainExportEnrichment-Full/azuredeploy.json +++ b/Solutions/SilentPush/Playbooks/SilentPush-DomainExportEnrichment-Full/azuredeploy.json @@ -4,6 +4,11 @@ "metadata": { "title": "SilentPush-DomainExportEnrichment-Full", "description": "Silent Push domains export with enrichment and TI upload", + "prerequisites": [ + "1. Deploy the Silent Push custom connector BEFORE creating this playbook. Installing the solution does not create it. Deploy it with the Deploy to Azure button on https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SilentPush/Connector/SilentPushCustomConnector (or deploy its azuredeploy.json as a custom template).", + "2. Deploy the connector into the same resource group where you create this playbook and keep its name as SilentPush-API (or use the same name in the CustomConnectorName parameter)." + ], + "prerequisitesDeployTemplateFile": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/SilentPush/Connector/SilentPushCustomConnector/azuredeploy.json", "postDeployment": [ "**Authorize the SilentPush connector connection**", "This playbook deploys with a placeholder (empty) API key for the SilentPush connector. Complete the connection before enabling/running the playbook:", @@ -28,7 +33,7 @@ "description": "The SilentPush API custom connector" } }, - "workspace": { + "WorkspaceName": { "type": "string", "metadata": { "description": "Log Analytics workspace name where Microsoft Sentinel is enabled" @@ -36,10 +41,9 @@ } }, "variables": { - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/workspaces', parameters('workspace'))]", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/workspaces', parameters('WorkspaceName'))]", "SilentPushConnectionName": "[parameters('PlaybookName')]", "MicrosoftSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]", - "silentPushApiId": "[resourceId('Microsoft.Web/customApis', parameters('CustomConnectorName'))]", "_SentinelContributorRoleGuid": "ab8e14d6-4a74-4a29-9ba8-549422addade", "SentinelContributorRoleId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('_SentinelContributorRoleGuid'))]", "maxExportSizeChars": "20000000", @@ -55,7 +59,7 @@ "properties": { "displayName": "[variables('SilentPushConnectionName')]", "api": { - "id": "[variables('silentPushApiId')]" + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/customApis/', parameters('CustomConnectorName'))]" }, "parameterValues": { "api_key": "" @@ -72,13 +76,16 @@ "displayName": "[variables('MicrosoftSentinelConnectionName')]", "parameterValueType": "Alternative", "api": { - "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', reference(resourceId('microsoft.OperationalInsights/workspaces', parameters('workspace')), '2025-07-01', 'Full').location, '/managedApis/azuresentinel')]" + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]" } } }, { "name": "[parameters('PlaybookName')]", "type": "Microsoft.Logic/workflows", + "tags": { + "hidden-SentinelTemplateVersion": "1.4" + }, "location": "[resourceGroup().location]", "identity": { "type": "SystemAssigned" @@ -325,7 +332,7 @@ "sourcesystem": "Silent Push - IOFA Export", "indicators": "@body('Build_TI_Indicators')" }, - "path": "[concat('/V2/ThreatIntelligence/', reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), '2025-07-01').customerId, '/UploadIndicators/')]", + "path": "[concat('/V2/ThreatIntelligence/', reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('WorkspaceName')), '2025-07-01').customerId, '/UploadIndicators/')]", "retryPolicy": { "type": "exponential", "count": 10, @@ -399,7 +406,7 @@ "azuresentinel": { "connectionId": "[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]", "connectionName": "[variables('MicrosoftSentinelConnectionName')]", - "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', reference(resourceId('microsoft.OperationalInsights/workspaces', parameters('workspace')), '2025-07-01', 'Full').location, '/managedApis/azuresentinel')]", + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]", "connectionProperties": { "authentication": { "type": "ManagedServiceIdentity" diff --git a/Solutions/SilentPush/Playbooks/SilentPush-DomainExportEnrichment-Full/readme.md b/Solutions/SilentPush/Playbooks/SilentPush-DomainExportEnrichment-Full/readme.md new file mode 100644 index 00000000000..2027d033aac --- /dev/null +++ b/Solutions/SilentPush/Playbooks/SilentPush-DomainExportEnrichment-Full/readme.md @@ -0,0 +1,41 @@ +# SilentPush-DomainExportEnrichment-Full + +## Summary + +Runs every 24 hours, downloads the full Silent Push IOFA domains export (`iofa-exports/all_iofas_domains.txt`), bulk-enriches the domains in batches of 100 and uploads them to Microsoft Sentinel Threat Intelligence as STIX indicators (Upload Indicators API). + +### Prerequisites + +1. A Silent Push API key ([sign up](https://app.silentpush.com)). +2. **Deploy the [Silent Push custom connector](../../Connector/SilentPushCustomConnector) first.** Installing the solution from Content Hub / Marketplace does **not** create it, and the connector does not appear under *Playbook templates*. Deploy it into the **same resource group** where you will create this playbook and keep its name as `SilentPush-API`. Otherwise *Create playbook* fails with "Connector 'SilentPush-API' not found". Deploy it here: + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FSilentPush%2FConnector%2FSilentPushCustomConnector%2Fazuredeploy.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FSilentPush%2FConnector%2FSilentPushCustomConnector%2Fazuredeploy.json) + +### Deployment instructions + +1. Click **Deploy to Azure** below. This opens the ARM template deployment wizard. +2. Fill in the parameters: + * **PlaybookName**: name of the playbook (default `SilentPush-DomainExportEnrichment-Full`). + * **CustomConnectorName**: name of the Silent Push custom connector deployed as a prerequisite above (default `SilentPush-API`). + * **WorkspaceName**: name of the Log Analytics workspace where Microsoft Sentinel is enabled (must be in the same resource group). + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FSilentPush%2FPlaybooks%2FSilentPush-DomainExportEnrichment-Full%2Fazuredeploy.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FSilentPush%2FPlaybooks%2FSilentPush-DomainExportEnrichment-Full%2Fazuredeploy.json) + +### Post-deployment instructions + +#### a. Authorize the Silent Push connection + +The playbook deploys with an empty API key for the Silent Push connection. + +1. Open the deployed Logic App and go to **API connections**. +2. Select the `` connection. +3. Go to **General > Edit API connection**. +4. Enter your Silent Push API key and click **Save**. + +#### b. Microsoft Sentinel connection + +The Microsoft Sentinel connection (`azuresentinel-`) uses the playbook's managed identity. The deployment grants it the **Microsoft Sentinel Contributor** role on the workspace, so the deploying user needs Owner or User Access Administrator rights on that workspace. + +#### c. Enable the playbook + +The playbook is deployed **Disabled**. Enable it once the connections are authorized. diff --git a/Solutions/SilentPush/Playbooks/SilentPush-DomainExportEnrichment-Sample/azuredeploy.json b/Solutions/SilentPush/Playbooks/SilentPush-DomainExportEnrichment-Sample/azuredeploy.json index 40f458665dd..73861c31f8b 100644 --- a/Solutions/SilentPush/Playbooks/SilentPush-DomainExportEnrichment-Sample/azuredeploy.json +++ b/Solutions/SilentPush/Playbooks/SilentPush-DomainExportEnrichment-Sample/azuredeploy.json @@ -4,6 +4,11 @@ "metadata": { "title": "SilentPush-DomainExportEnrichment-Sample", "description": "Silent Push domains export with enrichment", + "prerequisites": [ + "1. Deploy the Silent Push custom connector BEFORE creating this playbook. Installing the solution does not create it. Deploy it with the Deploy to Azure button on https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SilentPush/Connector/SilentPushCustomConnector (or deploy its azuredeploy.json as a custom template).", + "2. Deploy the connector into the same resource group where you create this playbook and keep its name as SilentPush-API (or use the same name in the CustomConnectorName parameter)." + ], + "prerequisitesDeployTemplateFile": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/SilentPush/Connector/SilentPushCustomConnector/azuredeploy.json", "postDeployment": [ "**Authorize the SilentPush connector connection**", "This playbook deploys with a placeholder (empty) API key for the SilentPush connector. Complete the connection before enabling/running the playbook:", @@ -30,8 +35,7 @@ } }, "variables": { - "SilentPushConnectionName": "[parameters('PlaybookName')]", - "silentPushApiId": "[resourceId('Microsoft.Web/customApis', parameters('CustomConnectorName'))]" + "SilentPushConnectionName": "[parameters('PlaybookName')]" }, "resources": [ { @@ -43,7 +47,7 @@ "properties": { "displayName": "[variables('SilentPushConnectionName')]", "api": { - "id": "[variables('silentPushApiId')]" + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/customApis/', parameters('CustomConnectorName'))]" }, "parameterValues": { "api_key": "" @@ -53,6 +57,9 @@ { "name": "[parameters('PlaybookName')]", "type": "Microsoft.Logic/workflows", + "tags": { + "hidden-SentinelTemplateVersion": "1.2" + }, "location": "[resourceGroup().location]", "identity": { "type": "SystemAssigned" diff --git a/Solutions/SilentPush/Playbooks/SilentPush-DomainExportEnrichment-Sample/readme.md b/Solutions/SilentPush/Playbooks/SilentPush-DomainExportEnrichment-Sample/readme.md new file mode 100644 index 00000000000..1ddf0b49c30 --- /dev/null +++ b/Solutions/SilentPush/Playbooks/SilentPush-DomainExportEnrichment-Sample/readme.md @@ -0,0 +1,36 @@ +# SilentPush-DomainExportEnrichment-Sample + +## Summary + +Runs every 24 hours, downloads the Silent Push IOFA domains export (`iofa-exports/all_iofas_domains.txt`), takes the first 100 domains and bulk-enriches them with Silent Push. It is a starting point to build your own playbook: it does not write the results anywhere. + +### Prerequisites + +1. A Silent Push API key ([sign up](https://app.silentpush.com)). +2. **Deploy the [Silent Push custom connector](../../Connector/SilentPushCustomConnector) first.** Installing the solution from Content Hub / Marketplace does **not** create it, and the connector does not appear under *Playbook templates*. Deploy it into the **same resource group** where you will create this playbook and keep its name as `SilentPush-API`. Otherwise *Create playbook* fails with "Connector 'SilentPush-API' not found". Deploy it here: + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FSilentPush%2FConnector%2FSilentPushCustomConnector%2Fazuredeploy.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FSilentPush%2FConnector%2FSilentPushCustomConnector%2Fazuredeploy.json) + +### Deployment instructions + +1. Click **Deploy to Azure** below. This opens the ARM template deployment wizard. +2. Fill in the parameters: + * **PlaybookName**: name of the playbook (default `SilentPush-DomainExportEnrichment-Sample`). + * **CustomConnectorName**: name of the Silent Push custom connector deployed as a prerequisite above (default `SilentPush-API`). + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FSilentPush%2FPlaybooks%2FSilentPush-DomainExportEnrichment-Sample%2Fazuredeploy.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FSilentPush%2FPlaybooks%2FSilentPush-DomainExportEnrichment-Sample%2Fazuredeploy.json) + +### Post-deployment instructions + +#### a. Authorize the Silent Push connection + +The playbook deploys with an empty API key for the Silent Push connection. + +1. Open the deployed Logic App and go to **API connections**. +2. Select the `` connection. +3. Go to **General > Edit API connection**. +4. Enter your Silent Push API key and click **Save**. + +#### b. Enable the playbook + +The playbook is deployed **Disabled**. Enable it once the connection is authorized. diff --git a/Solutions/SilentPush/Playbooks/SilentPush-IPExportEnrichment-Full/azuredeploy.json b/Solutions/SilentPush/Playbooks/SilentPush-IPExportEnrichment-Full/azuredeploy.json index 78d427f80d5..c4c4fec3f3a 100644 --- a/Solutions/SilentPush/Playbooks/SilentPush-IPExportEnrichment-Full/azuredeploy.json +++ b/Solutions/SilentPush/Playbooks/SilentPush-IPExportEnrichment-Full/azuredeploy.json @@ -4,6 +4,11 @@ "metadata": { "title": "SilentPush-IPExportEnrichment-Full", "description": "Silent Push IPs export with enrichment and TI upload", + "prerequisites": [ + "1. Deploy the Silent Push custom connector BEFORE creating this playbook. Installing the solution does not create it. Deploy it with the Deploy to Azure button on https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SilentPush/Connector/SilentPushCustomConnector (or deploy its azuredeploy.json as a custom template).", + "2. Deploy the connector into the same resource group where you create this playbook and keep its name as SilentPush-API (or use the same name in the CustomConnectorName parameter)." + ], + "prerequisitesDeployTemplateFile": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/SilentPush/Connector/SilentPushCustomConnector/azuredeploy.json", "postDeployment": [ "**Authorize the SilentPush connector connection**", "This playbook deploys with a placeholder (empty) API key for the SilentPush connector. Complete the connection before enabling/running the playbook:", @@ -28,7 +33,7 @@ "description": "The SilentPush API custom connector" } }, - "workspace": { + "WorkspaceName": { "type": "string", "metadata": { "description": "Log Analytics workspace name where Microsoft Sentinel is enabled" @@ -36,10 +41,9 @@ } }, "variables": { - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/workspaces', parameters('workspace'))]", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/workspaces', parameters('WorkspaceName'))]", "SilentPushConnectionName": "[parameters('PlaybookName')]", "MicrosoftSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]", - "silentPushApiId": "[resourceId('Microsoft.Web/customApis', parameters('CustomConnectorName'))]", "_SentinelContributorRoleGuid": "ab8e14d6-4a74-4a29-9ba8-549422addade", "SentinelContributorRoleId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('_SentinelContributorRoleGuid'))]", "maxExportSizeChars": "20000000", @@ -55,7 +59,7 @@ "properties": { "displayName": "[variables('SilentPushConnectionName')]", "api": { - "id": "[variables('silentPushApiId')]" + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/customApis/', parameters('CustomConnectorName'))]" }, "parameterValues": { "api_key": "" @@ -72,13 +76,16 @@ "displayName": "[variables('MicrosoftSentinelConnectionName')]", "parameterValueType": "Alternative", "api": { - "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', reference(resourceId('microsoft.OperationalInsights/workspaces', parameters('workspace')), '2025-07-01', 'Full').location, '/managedApis/azuresentinel')]" + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]" } } }, { "name": "[parameters('PlaybookName')]", "type": "Microsoft.Logic/workflows", + "tags": { + "hidden-SentinelTemplateVersion": "1.4" + }, "location": "[resourceGroup().location]", "identity": { "type": "SystemAssigned" @@ -342,7 +349,7 @@ "sourcesystem": "Silent Push - IOFA Export", "indicators": "@body('Build_TI_Indicators')" }, - "path": "[concat('/V2/ThreatIntelligence/', reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), '2025-07-01').customerId, '/UploadIndicators/')]", + "path": "[concat('/V2/ThreatIntelligence/', reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('WorkspaceName')), '2025-07-01').customerId, '/UploadIndicators/')]", "retryPolicy": { "type": "exponential", "count": 10, @@ -416,7 +423,7 @@ "azuresentinel": { "connectionId": "[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]", "connectionName": "[variables('MicrosoftSentinelConnectionName')]", - "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', reference(resourceId('microsoft.OperationalInsights/workspaces', parameters('workspace')), '2025-07-01', 'Full').location, '/managedApis/azuresentinel')]", + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]", "connectionProperties": { "authentication": { "type": "ManagedServiceIdentity" diff --git a/Solutions/SilentPush/Playbooks/SilentPush-IPExportEnrichment-Full/readme.md b/Solutions/SilentPush/Playbooks/SilentPush-IPExportEnrichment-Full/readme.md new file mode 100644 index 00000000000..d7a1d1b832d --- /dev/null +++ b/Solutions/SilentPush/Playbooks/SilentPush-IPExportEnrichment-Full/readme.md @@ -0,0 +1,41 @@ +# SilentPush-IPExportEnrichment-Full + +## Summary + +Runs every 24 hours, downloads the full Silent Push IOFA IPv4 export (`iofa-exports/all_iofas_ips.txt`), bulk-enriches the IPs in batches of 100 and uploads them to Microsoft Sentinel Threat Intelligence as STIX indicators (Upload Indicators API). + +### Prerequisites + +1. A Silent Push API key ([sign up](https://app.silentpush.com)). +2. **Deploy the [Silent Push custom connector](../../Connector/SilentPushCustomConnector) first.** Installing the solution from Content Hub / Marketplace does **not** create it, and the connector does not appear under *Playbook templates*. Deploy it into the **same resource group** where you will create this playbook and keep its name as `SilentPush-API`. Otherwise *Create playbook* fails with "Connector 'SilentPush-API' not found". Deploy it here: + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FSilentPush%2FConnector%2FSilentPushCustomConnector%2Fazuredeploy.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FSilentPush%2FConnector%2FSilentPushCustomConnector%2Fazuredeploy.json) + +### Deployment instructions + +1. Click **Deploy to Azure** below. This opens the ARM template deployment wizard. +2. Fill in the parameters: + * **PlaybookName**: name of the playbook (default `SilentPush-IPExportEnrichment-Full`). + * **CustomConnectorName**: name of the Silent Push custom connector deployed as a prerequisite above (default `SilentPush-API`). + * **WorkspaceName**: name of the Log Analytics workspace where Microsoft Sentinel is enabled (must be in the same resource group). + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FSilentPush%2FPlaybooks%2FSilentPush-IPExportEnrichment-Full%2Fazuredeploy.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FSilentPush%2FPlaybooks%2FSilentPush-IPExportEnrichment-Full%2Fazuredeploy.json) + +### Post-deployment instructions + +#### a. Authorize the Silent Push connection + +The playbook deploys with an empty API key for the Silent Push connection. + +1. Open the deployed Logic App and go to **API connections**. +2. Select the `` connection. +3. Go to **General > Edit API connection**. +4. Enter your Silent Push API key and click **Save**. + +#### b. Microsoft Sentinel connection + +The Microsoft Sentinel connection (`azuresentinel-`) uses the playbook's managed identity. The deployment grants it the **Microsoft Sentinel Contributor** role on the workspace, so the deploying user needs Owner or User Access Administrator rights on that workspace. + +#### c. Enable the playbook + +The playbook is deployed **Disabled**. Enable it once the connections are authorized. diff --git a/Solutions/SilentPush/Playbooks/SilentPush-IPExportEnrichment-Sample/azuredeploy.json b/Solutions/SilentPush/Playbooks/SilentPush-IPExportEnrichment-Sample/azuredeploy.json index 47eb260a6b6..9107cafd661 100644 --- a/Solutions/SilentPush/Playbooks/SilentPush-IPExportEnrichment-Sample/azuredeploy.json +++ b/Solutions/SilentPush/Playbooks/SilentPush-IPExportEnrichment-Sample/azuredeploy.json @@ -4,6 +4,11 @@ "metadata": { "title": "SilentPush-IPExportEnrichment-Sample", "description": "Silent Push IPs export with enrichment", + "prerequisites": [ + "1. Deploy the Silent Push custom connector BEFORE creating this playbook. Installing the solution does not create it. Deploy it with the Deploy to Azure button on https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SilentPush/Connector/SilentPushCustomConnector (or deploy its azuredeploy.json as a custom template).", + "2. Deploy the connector into the same resource group where you create this playbook and keep its name as SilentPush-API (or use the same name in the CustomConnectorName parameter)." + ], + "prerequisitesDeployTemplateFile": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/SilentPush/Connector/SilentPushCustomConnector/azuredeploy.json", "postDeployment": [ "**Authorize the SilentPush connector connection**", "This playbook deploys with a placeholder (empty) API key for the SilentPush connector. Complete the connection before enabling/running the playbook:", @@ -30,8 +35,7 @@ } }, "variables": { - "SilentPushConnectionName": "[parameters('PlaybookName')]", - "silentPushApiId": "[resourceId('Microsoft.Web/customApis', parameters('CustomConnectorName'))]" + "SilentPushConnectionName": "[parameters('PlaybookName')]" }, "resources": [ { @@ -43,7 +47,7 @@ "properties": { "displayName": "[variables('SilentPushConnectionName')]", "api": { - "id": "[variables('silentPushApiId')]" + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/customApis/', parameters('CustomConnectorName'))]" }, "parameterValues": { "api_key": "" @@ -53,6 +57,9 @@ { "name": "[parameters('PlaybookName')]", "type": "Microsoft.Logic/workflows", + "tags": { + "hidden-SentinelTemplateVersion": "1.2" + }, "location": "[resourceGroup().location]", "identity": { "type": "SystemAssigned" diff --git a/Solutions/SilentPush/Playbooks/SilentPush-IPExportEnrichment-Sample/readme.md b/Solutions/SilentPush/Playbooks/SilentPush-IPExportEnrichment-Sample/readme.md new file mode 100644 index 00000000000..d9f4676d406 --- /dev/null +++ b/Solutions/SilentPush/Playbooks/SilentPush-IPExportEnrichment-Sample/readme.md @@ -0,0 +1,36 @@ +# SilentPush-IPExportEnrichment-Sample + +## Summary + +Runs every 24 hours, downloads the Silent Push IOFA IPv4 export (`iofa-exports/all_iofas_ips.txt`), takes the first 100 IPs and bulk-enriches them with Silent Push. It is a starting point to build your own playbook: it does not write the results anywhere. + +### Prerequisites + +1. A Silent Push API key ([sign up](https://app.silentpush.com)). +2. **Deploy the [Silent Push custom connector](../../Connector/SilentPushCustomConnector) first.** Installing the solution from Content Hub / Marketplace does **not** create it, and the connector does not appear under *Playbook templates*. Deploy it into the **same resource group** where you will create this playbook and keep its name as `SilentPush-API`. Otherwise *Create playbook* fails with "Connector 'SilentPush-API' not found". Deploy it here: + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FSilentPush%2FConnector%2FSilentPushCustomConnector%2Fazuredeploy.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FSilentPush%2FConnector%2FSilentPushCustomConnector%2Fazuredeploy.json) + +### Deployment instructions + +1. Click **Deploy to Azure** below. This opens the ARM template deployment wizard. +2. Fill in the parameters: + * **PlaybookName**: name of the playbook (default `SilentPush-IPExportEnrichment-Sample`). + * **CustomConnectorName**: name of the Silent Push custom connector deployed as a prerequisite above (default `SilentPush-API`). + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FSilentPush%2FPlaybooks%2FSilentPush-IPExportEnrichment-Sample%2Fazuredeploy.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FSilentPush%2FPlaybooks%2FSilentPush-IPExportEnrichment-Sample%2Fazuredeploy.json) + +### Post-deployment instructions + +#### a. Authorize the Silent Push connection + +The playbook deploys with an empty API key for the Silent Push connection. + +1. Open the deployed Logic App and go to **API connections**. +2. Select the `` connection. +3. Go to **General > Edit API connection**. +4. Enter your Silent Push API key and click **Save**. + +#### b. Enable the playbook + +The playbook is deployed **Disabled**. Enable it once the connection is authorized. diff --git a/Solutions/SilentPush/ReleaseNotes.md b/Solutions/SilentPush/ReleaseNotes.md index 84bb8761a8c..e020a8ce537 100644 --- a/Solutions/SilentPush/ReleaseNotes.md +++ b/Solutions/SilentPush/ReleaseNotes.md @@ -1,4 +1,5 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | | ---|---|---| +| 3.2.0 | 28-10-2026 | Playbooks now declare a dependency on the SilentPush-API custom connector, and their prerequisites and new README files (with Deploy to Azure buttons) state that the connector must be deployed first in the same resource group, named SilentPush-API. Full playbooks: renamed the workspace parameter to WorkspaceName and the Microsoft Sentinel connection now uses the resource group location (fixes errors when creating them from the playbook template). Custom connector: the User-Agent header is now fixed and no longer a deployment parameter. | | 3.1.0 | 16-09-2026 | Added SilentPush Feeds Data Connector (Codeless/CCP) to ingest Silent Push threat-intel feed exports into SLP_Feeds_CL. | | 3.0.0 | 20-08-2026 | Initial solution release. | \ No newline at end of file