Using Logic Apps to automate enrichment of Sentinel incidents

Cloudsec 150

I am exploring automation options for enriching Sentinel incidents and would like to use my threat intel pane in Sentinel via Defender intel feeds. Is there a way to use Logic Apps to accomplish this instead of relying on multiple separate threat intel feeds and Logic Apps?

Andrew Blumhardt 9,496 Reputation points Microsoft Employee

2024-03-01T13:09:54.34+00:00

Please clarify your request with more details. I am not following the current description. You want one logic app to enrich incidents with IOCs from Sentinel and Defender XDR?

If you are on Azure commercial, the UEBA entity profile pages have an insight on the right side that will match entities to the Sentinel threat intelligence table (auto enrichment). Also, the ideal solution is to be alerted or blocked when an IOCs in Sentinel or XDR are detected (rather than as a post-incident enrichment). It would not be entirely useful to query these tables as an enrichment source. Most would query a 3rd party source like Virus Tutal as another source of validation.

Accepted answer

Luis Arias 4,721 Reputation points

2024-02-23T10:32:39.6033333+00:00
Hi Cloudsec, Yes, you can use Azure Logic Apps to automate the enrichment of Sentinel incidents. With Microsoft Sentinel playbooks, based on workflows built in Azure Logic Apps, can be used for your SOAR operations. Also you can connect directly to the Microsoft Defender Threat Intelligence feed.

A good example and tutorial connecting threat intelligence sources from playbooks is this one: https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/enrich-azure-sentinel-security-incidents-with-the-riskiq/ba-p/1534412

In essence, a playbook is a specialized Logic App designed to respond to Azure Sentinel triggers.

Reference:

https://learn.microsoft.com/en-us/Azure/sentinel/threat-intelligence-integration

https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks

https://learn.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook?tabs=LAC%2Cincidents

https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-automate-full-incident-lifecycle-with-incident-update/ba-p/3450306

I hope this information help you. Regards, Luis

If the information helped address your question, please Accept the answer.
Please sign in to rate this answer.
Cloudsec 150 Reputation points

2024-02-23T12:47:24.28+00:00

Hey thanks for the reply, I have built many logic apps for external TI platforms but was wondering if it was possible to do it with the in built threat intel from defender.

Rather than setting up alien vault etc.
Sign in to comment

Using Logic Apps to automate enrichment of Sentinel incidents

0 additional answers