How to install Sentinel Solutions specifically Playbooks and Connectors in Azure Gov

Question

How to install Sentinel Solutions specifically Playbooks and Connectors in Azure Gov

Muhammad Moosa 0

Hello Guys,

I am trying to install Azure Firewall Solution (Playboks and custom connectors) in Azure Gov Cloud.

I have installed the Azure Firewall Solution from Content Hub, The details shows that this solution has Custom Azure Logic Apps Connector and 3 playbooks, but they are not installed with this solution when I search it in Sentinel Automation Playbooks templates and custom connector is also missing in the respective service.

I udnerstand that I can install these playbooks and connectors from github from here:
https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Azure%20Firewall/Playbooks
Clicking on Deploy to Gov opens the ARM template in Azure Gov but validations fails seeming as if it cannot download the json files form the link?
User's image

I get this error when I am deploying the custom connector + 3 playbooks all together, we can install each playbook and connector seperately from github links which then passes the validation and starts deploying each playbook seperately but then I get another error.

For example deploy this playbook AzureFirewall-BlockIP-addToIPGroup, form this link: https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Azure%20Firewall/Playbooks/AzureFirewall-BlockIP-addToIPGroup

It starts deploying but then fails with this error:
**{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.","details":[{"code":"ApiNotFound","message":"The API 'AzureFirewallConnector' could not be found."}]}
**
User's image

I had somewhat similar errors in Azure Commerical as well but I was finally able to install the entire solution with connector and playbooks from link in this Microsoft Article: https://techcommunity.microsoft.com/t5/azure-network-security-blog/automated-detection-and-response-for-azure-firewall-with-logic/ba-p/2414224 by clicking Deploy to Azure under How to Deploy section. User's image

But the link in this article is only for Azure Commercial, I am not sure what is the difference in this link provided here and the github links, it seems both are the same by looking at the links of ARM templates.

I need to deploy this solution in Azure Gov but I am running into this issue and there seems to be no way around it.

Any direction and help to troubleshoot will be much appreciated.

Thank you.

Andrew Blumhardt 10,051 Reputation points Microsoft Employee

2024-03-13T12:40:27.92+00:00

Interesting issue, thanks for the detailed explanation. We probably need to do some digging on our end to get a response. I do see that the referenced article is a bit dated with broken links and a potential reference to a private repo. I suspect the issue on the Gov side is that the required logic app connectors may be missing. It is easy to add a Gov deployment URL to a logic app template but the developer may not have Gov access to test the result. I'll try to get more info this week.
Muhammad Moosa 0 Reputation points

2024-03-13T12:44:20.6966667+00:00

Thank you for looking into this, I will be waiting for this to be fixed and test it as soon as possible. Please let me know if you have any questions.

1 answer

Your answer

Andrew Blumhardt 10,051 Reputation points Microsoft Employee

2024-03-13T12:40:27.92+00:00

Interesting issue, thanks for the detailed explanation. We probably need to do some digging on our end to get a response. I do see that the referenced article is a bit dated with broken links and a potential reference to a private repo. I suspect the issue on the Gov side is that the required logic app connectors may be missing. It is easy to add a Gov deployment URL to a logic app template but the developer may not have Gov access to test the result. I'll try to get more info this week.
Muhammad Moosa 0 Reputation points

2024-03-13T12:44:20.6966667+00:00

Thank you for looking into this, I will be waiting for this to be fixed and test it as soon as possible. Please let me know if you have any questions.

Answer 1

Andrew Blumhardt 10,051 Microsoft Employee

Azure Gov does not appear to have the required Azure Firewall logic app connector and possibly a different version of the Virus Total connector. This is likely the cause. You could probably recreate these logic apps using direct API calls if this is critical. The data connector and analytic rules should work. Though the added value of these playbooks may not be worth the effort.

Muhammad Moosa 0 Reputation points

2024-03-14T12:28:02.91+00:00

Ok so it means I have to look into how to create Custome Connector for Azure Firewall (I dont need Virus Totla) and Logic Apps as well. Looks like a lot of work, I needed it for a proof of concept in Gov environment.

I would appreciate if you could give me hint or link towards how to do that easily if possible.
Andrew Blumhardt 10,051 Reputation points Microsoft Employee

2024-03-20T11:57:15.3533333+00:00

Sorry for the delay. You don't need a custom connector. You can use the HPPT action to call the API directly. There are several examples online. Basically, you run a get or put request to the firewall API and parse the input if needed. All logic app activities are API calls. It can be a difficult task initially but not impossible. Here is an example.

https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/azure-rest-api-through-logic-app/ba-p/2193956

https://learn.microsoft.com/en-us/rest/api/firewall/
Muhammad Moosa 0 Reputation points

2024-03-27T12:27:46.24+00:00

Thank you, I will see how far I can get it done myself.

Share via

How to install Sentinel Solutions specifically Playbooks and Connectors in Azure Gov

1 answer

Your answer