Additional-AzureResources.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "_generator": {
      "name": "bicep",
      "version": "0.30.23.60470",
      "templateHash": "12828731240264018312"
    },
    "support": {
      "tier": "Community",
      "name": "baseVISION AG",
      "email": "support@basevision.ch"
    },
    "author": "baseVISION - support@basevision.ch",
    "comments": "Solution template for baseVISION Threat Intelligence"
  },
  "parameters": {
    "workspace_location": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "Region to deploy solution resources"
      }
    },
    "workspace": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "Workspace name of Log Analytics where Microsoft Sentinel is setup"
      }
    },
    "TaxiiFeedName": {
      "type": "string",
      "defaultValue": "baseVISION-SOC-TI-Feeds",
      "minLength": 1,
      "metadata": {
        "description": "Name of the Taxii Feed which was configured in the TAXII connector"
      }
    },
    "la_basevisionti_telemetry_name": {
      "type": "string",
      "defaultValue": "la-basevisionti-telemetry",
      "minLength": 1,
      "metadata": {
        "description": "Name of the telemetry improvement playbook (Logic Apps resource) which will be created"
      }
    },
    "workbookTiDashboard_name": {
      "type": "string",
      "defaultValue": "baseVISION SOC TI Feed Dashboard",
      "minLength": 1,
      "metadata": {
        "description": "Name of the workbook which will be created"
      }
    }
  },
  "variables": {
    "workbook_source": "[format('{0}/providers/Microsoft.OperationalInsights/workspaces/{1}', resourceGroup().id, parameters('workspace'))]",
    "_workbook_source": "[variables('workbook_source')]",
    "workbookTiDashboardClean_name": "[replace(parameters('workbookTiDashboard_name'), ' ', '')]"
  },
  "resources": [
    {
      "type": "Microsoft.Insights/workbooks",
      "apiVersion": "2023-06-01",
      "name": "[guid(variables('workbookTiDashboardClean_name'))]",
      "location": "[parameters('workspace_location')]",
      "kind": "shared",
      "properties": {
        "displayName": "[format('{0}', parameters('workbookTiDashboard_name'))]",
        "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"91f52358-d124-4e1f-903e-519801764521\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Timerange\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}]},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":2592000000}},{\"id\":\"72128dde-c135-4fea-a974-5d4a3b4e833d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SentinelWorkspace\",\"label\":\"Sentinel Workspace\",\"type\":5,\"isRequired\":true,\"query\":\"resources\\r\\n| where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| project value =id, label = name\",\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"queryType\":1,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":\"/subscriptions/8aaae4cc-ebea-4018-8601-ea211c548683/resourceGroups/weu-prd-rg-sentinel-01/providers/Microsoft.OperationalInsights/workspaces/weu-prd-log-sentinel-01\"},{\"id\":\"3a197370-bae7-4f13-b3ba-9639531ada8f\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatIntelFeed\",\"label\":\"Threat Intel Feed to analyze\",\"type\":2,\"isRequired\":true,\"query\":\"ThreatIntelIndicators\\r\\n| distinct SourceSystem\",\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timerange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":\"baseVISION-SOC-TI-Feeds\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 3\"},{\"type\":1,\"content\":{\"json\":\"## baseVISION Threat Intel Dashboard\\n---\"},\"name\":\"text - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"Our Threat Intel Feeds offer a unique and comprehensive solution, integrating Threat Intelligence Feeds, Proactive Threat Hunting, and Cyber Threat Intelligence. With high-quality detections and substantial ingest volume, our feeds provide actionable insights and preemptive threat mitigation, ensuring robust security for your organization. This dashboard provides insights about the feed.\"},\"customWidth\":\"70\",\"name\":\"description\"},{\"type\":1,\"content\":{\"json\":\"<svg id=\\\"Ebene_2\\\" xmlns=\\\"http://www.w3.org/2000/svg\\\" viewBox=\\\"0 0 388.44 59.12\\\"><defs><style>.cls-1,.cls-2,.cls-3{stroke-width:0px;}</style></defs><g id=\\\"Ebene_1-2\\\"><path class=\\\"cls-1\\\" style=\\\"fill:#f48e00;\\\" d=\\\"M39.65,37.61c0,2.87-.53,5.55-1.58,8.03-1.05,2.49-2.48,4.66-4.27,6.53-1.8,1.87-3.9,3.34-6.31,4.42-2.41,1.07-4.98,1.61-7.7,1.61-3.7,0-7.03-.96-10.01-2.89-2.98-1.92-5.29-4.45-6.93-7.58v9.55H0V0h2.85v27.25c1.64-3.16,3.95-5.71,6.93-7.64,2.98-1.94,6.31-2.91,10.01-2.91,2.72,0,5.29.55,7.7,1.65,2.41,1.1,4.52,2.6,6.31,4.5,1.8,1.9,3.22,4.11,4.27,6.65,1.05,2.54,1.58,5.24,1.58,8.11ZM36.8,37.57c0-2.46-.44-4.8-1.31-7.01-.87-2.21-2.08-4.12-3.63-5.74-1.54-1.62-3.34-2.9-5.4-3.85-2.06-.95-4.27-1.42-6.64-1.42s-4.5.48-6.56,1.42c-2.06.95-3.86,2.23-5.4,3.85-1.54,1.62-2.77,3.53-3.67,5.74-.9,2.21-1.35,4.54-1.35,7.01s.45,4.77,1.35,6.93c.9,2.16,2.12,4.04,3.67,5.66,1.54,1.62,3.34,2.89,5.4,3.81s4.24,1.39,6.56,1.39,4.58-.46,6.64-1.39,3.86-2.19,5.4-3.81c1.54-1.62,2.75-3.5,3.63-5.66s1.31-4.47,1.31-6.93Z\\\"/><path class=\\\"cls-1\\\" style=\\\"fill:#f48e00;\\\" d=\\\"M76.6,57.28c-.36-.72-.63-1.55-.81-2.5-.18-.95-.27-2.04-.27-3.27v-.77c-1.59,2.26-3.85,4.03-6.78,5.31-2.93,1.28-6.36,1.92-10.32,1.92-1.75,0-3.48-.22-5.2-.65-1.72-.44-3.26-1.12-4.62-2.04-1.36-.92-2.46-2.08-3.31-3.46-.85-1.39-1.27-3.03-1.27-4.93,0-2.26.47-4.11,1.42-5.54.95-1.44,2.22-2.59,3.81-3.46,1.59-.87,3.4-1.51,5.43-1.92,2.03-.41,4.09-.72,6.2-.92,2.21-.2,4.21-.44,6-.69,1.8-.26,3.34-.63,4.62-1.12,1.28-.49,2.27-1.1,2.96-1.85.69-.74,1.04-1.73,1.04-2.96,0-1.85-.4-3.35-1.19-4.5-.8-1.15-1.81-2.07-3.04-2.73-1.23-.67-2.61-1.13-4.12-1.39-1.51-.26-2.99-.38-4.43-.38-3.65,0-6.62.72-8.93,2.16-2.31,1.44-3.9,3.52-4.77,6.24h-2.93c.87-3.54,2.73-6.3,5.58-8.28,2.85-1.98,6.53-2.96,11.05-2.96,4.98,0,8.83,1.03,11.55,3.09,2.72,2.06,4.08,4.96,4.08,8.72v22.45c0,1.03.12,2.17.35,3.43.23,1.26.5,2.28.81,3.05h-2.93ZM75.53,33.8c-.77.72-1.69,1.3-2.77,1.73-1.08.44-2.25.8-3.5,1.08-1.26.28-2.57.5-3.93.65-1.36.15-2.73.28-4.12.39-5.08.51-8.7,1.49-10.86,2.93-2.16,1.44-3.23,3.52-3.23,6.24,0,1.64.41,3,1.23,4.08.82,1.08,1.81,1.92,2.96,2.54s2.39,1.05,3.7,1.31c1.31.26,2.45.38,3.43.38,2.16,0,4.25-.24,6.27-.73,2.03-.49,3.85-1.23,5.47-2.23,1.62-1,2.91-2.27,3.89-3.81.97-1.54,1.46-3.36,1.46-5.47v-9.08Z\\\"/><path class=\\\"cls-1\\\" style=\\\"fill:#f48e00;\\\" d=\\\"M120.56,46.04c.05,1.39-.15,2.73-.6,4.04-.45,1.31-1.15,2.48-2.1,3.5-1.44,1.49-3.29,2.63-5.54,3.43-2.26.8-4.77,1.19-7.54,1.19-5.03,0-9.19-1.06-12.47-3.2-3.29-2.13-5.26-5.22-5.93-9.28h2.85c.72,3.23,2.43,5.67,5.12,7.31,2.69,1.64,6.15,2.46,10.35,2.46,2.41,0,4.57-.36,6.47-1.08,1.9-.72,3.44-1.67,4.62-2.85,1.44-1.54,2.08-3.36,1.92-5.47-.1-2.41-1.22-4.29-3.36-5.62-2.14-1.33-5.62-2.36-10.46-3.08-1.7-.26-3.46-.55-5.29-.89-1.83-.33-3.49-.85-4.98-1.54s-2.73-1.64-3.71-2.85c-.98-1.21-1.49-2.78-1.54-4.73,0-1.33.31-2.66.94-3.97.62-1.31,1.56-2.46,2.81-3.46,1.25-1,2.81-1.81,4.68-2.43,1.87-.62,4.04-.92,6.51-.92,4.41,0,8.01.95,10.78,2.85,2.77,1.9,4.59,4.65,5.47,8.24h-2.93c-.82-2.67-2.35-4.73-4.58-6.2-2.23-1.46-5.12-2.19-8.66-2.19-1.8,0-3.44.21-4.93.62-1.49.41-2.77.98-3.85,1.69-1.08.72-1.91,1.58-2.5,2.58-.59,1-.89,2.07-.89,3.2.05,2.26,1.13,3.88,3.24,4.85,2.11.98,5.38,1.77,9.8,2.39,2.06.31,4.05.71,5.98,1.19,1.93.49,3.64,1.16,5.13,2,1.49.85,2.7,1.92,3.63,3.23.93,1.31,1.44,2.96,1.54,4.97Z\\\"/><path class=\\\"cls-1\\\" style=\\\"fill:#f48e00;\\\" d=\\\"M128.11,37.42c0,2.57.46,4.95,1.39,7.16.92,2.21,2.17,4.11,3.73,5.7,1.56,1.59,3.4,2.84,5.5,3.73,2.1.9,4.36,1.35,6.77,1.35s4.32-.29,6.04-.89c1.72-.59,3.19-1.37,4.43-2.35,1.23-.97,2.26-2.08,3.08-3.31.82-1.23,1.46-2.51,1.92-3.85h3c-1.39,4.31-3.65,7.6-6.77,9.85-3.13,2.26-7.03,3.39-11.7,3.39-2.82,0-5.47-.54-7.93-1.61-2.46-1.08-4.61-2.54-6.43-4.38-1.82-1.84-3.26-4.02-4.31-6.53-1.05-2.51-1.58-5.2-1.58-8.07s.51-5.57,1.54-8.11c1.03-2.54,2.44-4.75,4.23-6.65,1.8-1.9,3.9-3.39,6.31-4.5,2.41-1.1,4.98-1.65,7.7-1.65,2.98,0,5.68.61,8.12,1.84,2.44,1.23,4.53,2.83,6.27,4.79,1.74,1.97,3.09,4.18,4.04,6.63.95,2.46,1.4,4.94,1.35,7.44h-36.72ZM161.75,34.57c-.36-2.16-1.04-4.14-2.04-5.97-1-1.82-2.25-3.4-3.73-4.74-1.49-1.33-3.17-2.39-5.04-3.16-1.87-.77-3.84-1.15-5.89-1.15s-4.09.39-5.97,1.15c-1.87.77-3.54,1.82-5,3.16-1.46,1.34-2.69,2.91-3.7,4.74-1,1.82-1.66,3.81-1.96,5.97h33.34Z\\\"/><path class=\\\"cls-2\\\"  style=\\\"fill:#12120d;\\\" d=\\\"M191.61,58.12h-6.39l-17.97-48.71h6.46l14.67,41.34,14.74-41.34h6.39l-17.9,48.71Z\\\"/><path class=\\\"cls-2\\\" style=\\\"fill:#12120d;\\\" d=\\\"M223.06,58.12h-5.97V9.41h5.97v48.71Z\\\"/><path class=\\\"cls-2\\\" style=\\\"fill:#12120d;\\\" d=\\\"M269.74,44.29c0,2.39-.45,4.49-1.33,6.32-.89,1.83-2.14,3.36-3.75,4.6-1.61,1.24-3.56,2.18-5.83,2.81-2.27.63-4.77.95-7.49.95s-5.37-.39-7.67-1.17c-2.3-.78-4.26-1.89-5.87-3.33-1.62-1.44-2.87-3.17-3.76-5.18-.89-2.01-1.34-4.24-1.34-6.67h6.18c0,3.28,1.15,5.86,3.44,7.76,2.29,1.89,5.29,2.84,8.98,2.84,4.21,0,7.33-.81,9.37-2.42,2.04-1.61,3.05-3.8,3.05-6.56,0-1.03-.15-1.98-.46-2.84-.3-.87-.9-1.65-1.79-2.35s-2.17-1.34-3.83-1.93c-1.66-.58-3.83-1.11-6.49-1.58-2.71-.47-5.12-1.05-7.23-1.75-2.11-.7-3.88-1.58-5.33-2.63-1.45-1.05-2.55-2.33-3.3-3.83-.75-1.5-1.12-3.3-1.12-5.41s.4-4,1.19-5.69c.79-1.68,1.93-3.12,3.4-4.32,1.47-1.19,3.26-2.12,5.37-2.77,2.11-.65,4.45-.98,7.02-.98s5.07.36,7.2,1.07c2.13.71,3.94,1.73,5.44,3.05,1.5,1.33,2.64,2.92,3.44,4.79.8,1.87,1.19,3.98,1.19,6.32h-5.97c0-2.85-.95-5.15-2.85-6.88-1.9-1.73-4.68-2.6-8.34-2.6s-6.59.74-8.37,2.21c-1.78,1.47-2.67,3.36-2.67,5.65,0,1.08.16,2.01.49,2.81.33.8.95,1.51,1.87,2.14.91.63,2.17,1.21,3.76,1.72s3.63,1.01,6.12,1.47c2.67.52,5.08,1.11,7.21,1.79,2.13.68,3.95,1.57,5.45,2.67,1.5,1.1,2.64,2.45,3.44,4.04.79,1.59,1.19,3.56,1.19,5.9Z\\\"/><path class=\\\"cls-2\\\" style=\\\"fill:#12120d;\\\" d=\\\"M284.2,58.12h-5.97V9.41h5.97v48.71Z\\\"/><path class=\\\"cls-2\\\" style=\\\"fill:#12120d;\\\" d=\\\"M388.44,58.12h-6.6l-26.18-39.66v39.66h-5.97V9.41h6.65l26.13,39.59V9.41h5.97v48.71Z\\\"/><path class=\\\"cls-2\\\" style=\\\"fill:#12120d;\\\" d=\\\"M317.09,8.07c-14.1,0-25.52,11.43-25.52,25.52s11.43,25.52,25.52,25.52,25.52-11.43,25.52-25.52-11.43-25.52-25.52-25.52ZM317.09,53.12c-10.78,0-19.52-8.74-19.52-19.52s8.74-19.52,19.52-19.52,19.52,8.74,19.52,19.52-8.74,19.52-19.52,19.52Z\\\"/><path class=\\\"cls-3\\\" style=\\\"fill:#f48e00;\\\" d=\\\"M317.09,20.24c-.64,0-1.26.06-1.88.15,1.76,1.17,2.91,3.16,2.91,5.43,0,3.6-2.92,6.51-6.51,6.51-3.07,0-5.63-2.12-6.32-4.97-.99,1.86-1.55,3.98-1.55,6.24,0,7.37,5.98,13.35,13.35,13.35s13.35-5.98,13.35-13.35-5.98-13.35-13.35-13.35Z\\\"/></g></svg>\"},\"customWidth\":\"30\",\"name\":\"logo\",\"styleSettings\":{\"padding\":\"20px\"}}]},\"name\":\"group - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"\\r\\nThreatIntelIndicators | where SourceSystem == '{ThreatIntelFeed:value}' and LastUpdateMethod != 'LogARepublisher' | where TimeGenerated {Timerange:query}\\r\\n| summarize count() by IndicatorType=tostring(split(ObservableKey,\\\":\\\",0)[0]), bin(TimeGenerated, 1d)\\r\\n| union (ThreatIntelObjects | where SourceSystem == '{ThreatIntelFeed:value}' and LastUpdateMethod != 'LogARepublisher' | where TimeGenerated {Timerange:query} | summarize count() by IndicatorType=StixType, bin(TimeGenerated, 1d))\\r\\n| render barchart kind=stacked \",\"size\":1,\"title\":\"Indicators Imported into Sentinel by Indicator Type and Date\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{SentinelWorkspace}\"]},\"customWidth\":\"100\",\"name\":\"ti-types\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ThreatIntelIndicators\\r\\n| where LastUpdateMethod != 'LogARepublisher'\\r\\n| extend Indicator=ObservableValue\\r\\n| project-keep TimeGenerated,SourceSystem,Indicator\\r\\n| summarize arg_min(TimeGenerated,*) by Indicator,SourceSystem\\r\\n| summarize Count=count(), bV=minif(TimeGenerated,SourceSystem == '{ThreatIntelFeed:value}'), Other=minif(TimeGenerated,SourceSystem != '{ThreatIntelFeed:value}') by Indicator\\r\\n| where Count > 1\\r\\n| extend IngestionDifference = Other-bV\\r\\n| project-keep Indicator,IngestionDifference\\r\\n| summarize IngestionDifferenceAvg=avg(IngestionDifference),IngestionDifferenceMin=min(IngestionDifference),IngestionDifferenceMax=max(IngestionDifference)\\r\\n| extend Type=dynamic([\\\"Avg\\\",\\\"Min\\\",\\\"Max\\\"])\\r\\n| mv-expand Type\\r\\n| extend Result = iff(Type=='Avg',IngestionDifferenceAvg,iff(Type=='Min',IngestionDifferenceMin,iff(Type=='Max',IngestionDifferenceMax, totimespan(0))))\\r\\n| project-keep Type,Result\",\"size\":3,\"title\":\"Reaction Time (Faster than other feeds)\",\"timeContextFromParameter\":\"Timerange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{SentinelWorkspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Type\"},\"leftContent\":{\"columnMatch\":\"Result\",\"formatter\":1,\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":false},\"emptyValCustomText\":\"-\"}},\"showBorder\":false}},\"name\":\"ti-time\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let ti = ThreatIntelIndicators \\n    | where TimeGenerated {Timerange:query} and LastUpdateMethod != 'LogARepublisher'\\n    | extend ioc=ObservableValue\\n    | project-keep ioc,SourceSystem\\n    | distinct ioc,SourceSystem;\\nti \\n    | where SourceSystem == \\\"{ThreatIntelFeed:value}\\\" \\n    | join kind=fullouter (ti | where SourceSystem != \\\"{ThreatIntelFeed:value}\\\") on $left.ioc == $right.ioc\\n    | extend Source = iif(isempty(ioc) and isnotempty(ioc1) ,'Only on other feeds', iif(isempty(ioc1) and isnotempty(ioc),'{ThreatIntelFeed:value}',iif(isnotempty(ioc1) and isnotempty(ioc),'Both', 'Unknown') ))\\n    | summarize Count = count() by Source\\n    | render piechart \",\"size\":2,\"title\":\"TI Feed Uniqueness\",\"noDataMessage\":\"No indicators ingested. Check your connector configuration.\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{SentinelWorkspace}\"]},\"customWidth\":\"33\",\"name\":\"ti-uniqueness\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let tiObservables = ThreatIntelIndicators\\r\\n    | where TimeGenerated < now()\\r\\n    | where SourceSystem == '{ThreatIntelFeed:value}'\\r\\n    | project\\r\\n        IsActive,\\r\\n        IndicatorTime = TimeGenerated,\\r\\n        Indicator = ObservableValue,\\r\\n        SourceSystem;\\r\\nlet alertEntity = SecurityAlert \\r\\n    | where TimeGenerated {Timerange:query}\\r\\n    | project parse_json(Entities), SystemAlertId, AlertTime = TimeGenerated\\r\\n    | mvexpand(Entities)\\r\\n    | extend entity = iif(\\r\\n                          isnotempty(Entities.Address),\\r\\n                          Entities.Address,\\r\\n                          iif(\\r\\n    isnotempty(Entities.HostName),\\r\\n    strcat(Entities.HostName, \\\".\\\", Entities.DnsDomain),\\r\\n    iif(\\r\\n    isnotempty(Entities.Url),\\r\\n    Entities.Url,\\r\\n    iif(\\r\\n    isnotempty(Entities.Value),\\r\\n    Entities.Value,\\r\\n    iif(Entities.Type == \\\"account\\\", strcat(Entities.Name, \\\"@\\\", Entities.UPNSuffix), \\\"\\\")\\r\\n)\\r\\n)\\r\\n)\\r\\n                      )\\r\\n    | where isnotempty(entity) \\r\\n    | project entity, SystemAlertId, AlertTime;\\r\\nlet IncidentAlerts = SecurityIncident\\r\\n    | project IncidentTime = TimeGenerated, IncidentNumber, Title, parse_json(AlertIds), Classification = iif(isempty(Classification),'Unclassified',Classification)\\r\\n    | mv-expand AlertIds\\r\\n    | project IncidentTime, IncidentNumber, Title, tostring(AlertIds),Classification;\\r\\nlet AlertsWithTiObservables = alertEntity\\r\\n    | join kind=inner tiObservables on $left.entity == $right.Indicator;\\r\\nlet IncidentsWithAlertsWithTiObservables = AlertsWithTiObservables\\r\\n    | join kind=inner IncidentAlerts on $left.SystemAlertId == $right.AlertIds;\\r\\nIncidentsWithAlertsWithTiObservables\\r\\n| where Indicator contains '' or Indicator == \\\"*\\\"\\r\\n| summarize Incidents=dcount(IncidentNumber), Alerts=dcount(SystemAlertId) by Indicator, Source = SourceSystem, Classification\\r\\n| sort by Incidents, Alerts desc\\r\\n| summarize Count = count() by Classification\\r\\n| render piechart \\r\\n\",\"size\":2,\"title\":\"TI Feed Quality\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{SentinelWorkspace}\"]},\"customWidth\":\"33\",\"name\":\"ti-quality\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ThreatIntelIndicators\\r\\n| where SourceSystem == '{ThreatIntelFeed:value}' and LastUpdateMethod != 'LogARepublisher'\\r\\n// Select all indicators from the table\\r\\n| where TimeGenerated < now()\\r\\n// Select only indicators that have not expired\\r\\n    and ValidUntil > now()\\r\\n// Select only indicators that are marked active\\r\\n    and IsActive == true\\r\\n// Select only the most recently ingested copy of an indicator\\r\\n| summarize arg_max(TimeGenerated, *) by Id\\r\\n// Summarize and order the data, then render the chart\\r\\n| summarize CountOfIndicators = count() by tostring(Confidence)\\r\\n| order by CountOfIndicators desc \\r\\n| render piechart\",\"size\":2,\"title\":\"Confidence Scores\",\"timeContextFromParameter\":\"Timerange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{SentinelWorkspace}\"]},\"customWidth\":\"33\",\"name\":\"ti-confidence\"}],\"isLocked\":false,\"fallbackResourceIds\":[\"/subscriptions/8aaae4cc-ebea-4018-8601-ea211c548683/resourcegroups/weu-prd-rg-sentinel-01/providers/microsoft.operationalinsights/workspaces/weu-prd-log-sentinel-01\"],\"fromTemplateId\":\"sentinel-baseVISIONTiFeedDashboard\"}",
        "version": "1.0",
        "sourceId": "[variables('_workbook_source')]",
        "category": "sentinel"
      }
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "la-basevisionti-telemetry",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "location": {
            "value": "[parameters('workspace_location')]"
          },
          "PlaybookName": {
            "value": "[parameters('la_basevisionti_telemetry_name')]"
          },
          "workspace": {
            "value": "[parameters('workspace')]"
          },
          "TaxiiFeedName": {
            "value": "[parameters('TaxiiFeedName')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.30.23.60470",
              "templateHash": "7258110993496612736"
            },
            "title": "baseVISION Threat Intel - Telemetry",
            "description": "This playbook is triggered every four hours and sends basic telemetry to baseVISION to improve the feeds. The telemetry data only contains IOC's provided by baseVISION together with the analysts classification of incidents associated with it.",
            "mainSteps": [
              "1. Collect Telemetry",
              "2. Send data to baseVISION"
            ],
            "prerequisites": [
              "baseVISION TI Feed in TAXII connector configured"
            ],
            "postdeployment": [],
            "lastUpdateTime": "2025-02-17T00:00:00.000Z",
            "entities": [],
            "tags": [],
            "support": {
              "tier": "Community",
              "name": "baseVISION AG",
              "email": "support@basevision.ch"
            },
            "author": {
              "name": "baseVISION AG"
            }
          },
          "parameters": {
            "PlaybookName": {
              "type": "string",
              "defaultValue": "la-basevisionti-telemetry",
              "metadata": {
                "description": "Name of the playbook (Logic Apps resource) which will be created"
              }
            },
            "location": {
              "type": "string",
              "defaultValue": ""
            },
            "TaxiiFeedName": {
              "type": "string",
              "defaultValue": "baseVISION-SOC-TI-Feed",
              "minLength": 1,
              "metadata": {
                "description": "Name of the Taxii Feed which was configured in the TAXII connector. If multiple feeds/collections from baseVISION are configured only specify the start of the name which should be for all feeds/collections the same."
              }
            },
            "workspace": {
              "type": "string",
              "defaultValue": "<Enter Log Analytics Workspace>",
              "minLength": 1,
              "metadata": {
                "description": "Workspace name for Azure Log Analytics where Azure Sentinel is setup"
              }
            }
          },
          "variables": {
            "laName": "[parameters('PlaybookName')]",
            "azureSentinelConnectionName": "[format('{0}-azmon-connection', parameters('PlaybookName'))]",
            "uamiName": "[format('{0}-uami', parameters('PlaybookName'))]",
            "roleDefinitionSentinelReaderId": "8d289c81-5878-46d4-8554-54e1e3d8b5cb"
          },
          "resources": [
            {
              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
              "apiVersion": "2024-11-30",
              "name": "[variables('uamiName')]",
              "location": "[parameters('location')]"
            },
            {
              "type": "Microsoft.Web/connections",
              "apiVersion": "2016-06-01",
              "name": "[variables('azureSentinelConnectionName')]",
              "location": "[parameters('location')]",
              "tags": {},
              "properties": {
                "displayName": "[variables('azureSentinelConnectionName')]",
                "customParameterValues": {},
                "api": {
                  "id": "[format('/subscriptions/{0}/providers/Microsoft.Web/locations/{1}/managedApis/azuremonitorlogs', subscription().subscriptionId, parameters('location'))]"
                },
                "parameterValueSet": {
                  "name": "managedIdentityAuth",
                  "values": {}
                }
              }
            },
            {
              "type": "Microsoft.Logic/workflows",
              "apiVersion": "2019-05-01",
              "name": "[variables('laName')]",
              "location": "[parameters('location')]",
              "identity": {
                "type": "UserAssigned",
                "userAssignedIdentities": {
                  "[format('{0}', resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('uamiName')))]": {}
                }
              },
              "properties": {
                "state": "Enabled",
                "definition": {
                  "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
                  "contentVersion": "1.0.0.0",
                  "parameters": {
                    "TaxiiFeedName": {
                      "defaultValue": "[parameters('TaxiiFeedName')]",
                      "type": "String"
                    },
                    "SubscriptionId": {
                      "defaultValue": "[subscription().subscriptionId]",
                      "type": "String"
                    },
                    "ResourceGroupName": {
                      "defaultValue": "[resourceGroup().name]",
                      "type": "String"
                    },
                    "SentinelName": {
                      "defaultValue": "[parameters('workspace')]",
                      "type": "String"
                    },
                    "$connections": {
                      "defaultValue": {},
                      "type": "Object"
                    }
                  },
                  "triggers": {
                    "Sliding_Window": {
                      "recurrence": {
                        "interval": 4,
                        "frequency": "Hour"
                      },
                      "evaluatedRecurrence": {
                        "interval": 4,
                        "frequency": "Hour"
                      },
                      "type": "SlidingWindow"
                    }
                  },
                  "actions": {
                    "Get_Telemetry_Data": {
                      "runAfter": {},
                      "type": "ApiConnection",
                      "inputs": {
                        "host": {
                          "connection": {
                            "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']"
                          }
                        },
                        "method": "post",
                        "body": {
                          "query": "let tiObservables = ThreatIntelIndicators\n    | where TimeGenerated < now()\n    | where SourceSystem startswith \"@{parameters('TaxiiFeedName')}\"\n    | project\n        IndicatorId=Id,\n        ThreatType= strcat_array(Data.indicator_types,\",\") ,\n        Description= tostring(Data.description),\n        Active=IsActive,\n        IndicatorTime = TimeGenerated,\n        Indicator = ObservableValue,\n        SourceSystem;\nlet alertEntity = SecurityAlert\n    | where TimeGenerated > ago(1d)\n    | project parse_json(Entities), SystemAlertId, AlertTime = TimeGenerated\n    | mvexpand(Entities)\n    | extend entity = iif(isnotempty(Entities.Address), Entities.Address, iif(isnotempty(Entities.HostName), strcat(Entities.HostName, \" .\", Entities.DnsDomain), iif(isnotempty(Entities.Url), Entities.Url, iif(isnotempty(Entities.Value), Entities.Value, iif(Entities.Type == \" account\", strcat(Entities.Name, \" @\", Entities.UPNSuffix), \" \")))))\n    | where isnotempty(entity)\n    | project entity, SystemAlertId, AlertTime;\nlet IncidentAlerts = SecurityIncident\n    | project\n        IncidentTime = TimeGenerated,\n        IncidentNumber,\n        Title,\n        parse_json(AlertIds),\n        Classification = iif(isempty(Classification), \"Unclassified\", Classification)\n    | mv-expand AlertIds\n    | project IncidentTime, IncidentNumber, Title, tostring(AlertIds), Classification;\nlet AlertsWithTiObservables = alertEntity\n    | join kind=inner tiObservables on $left.entity == $right.Indicator;\nlet IncidentsWithAlertsWithTiObservables = AlertsWithTiObservables\n    | join kind=inner IncidentAlerts on $left.SystemAlertId == $right.AlertIds;\nIncidentsWithAlertsWithTiObservables\n| where Indicator contains '' or Indicator == \" *\"\n| summarize Incidents=dcount(IncidentNumber), Alerts=dcount(SystemAlertId) by Indicator, ThreatType, Source = SourceSystem, Description, Classification,Version=2\n",
                          "timerangetype": "Exact",
                          "timerange": {
                            "exactTimeRangeFrom": "@triggerOutputs()['windowStartTime']",
                            "exactTimeRangeTo": "@triggerOutputs()['windowEndTime']"
                          }
                        },
                        "path": "/queryDataV2",
                        "queries": {
                          "subscriptions": "@parameters('SubscriptionId')",
                          "resourcegroups": "@parameters('ResourceGroupName')",
                          "resourcetype": "Log Analytics Workspace",
                          "resourcename": "@parameters('SentinelName')"
                        }
                      }
                    },
                    "Send_Telemetry_to_baseVISION": {
                      "runAfter": {
                        "Get_Telemetry_Data": [
                          "Succeeded"
                        ]
                      },
                      "type": "Http",
                      "inputs": {
                        "uri": "https://prod-26.switzerlandnorth.logic.azure.com:443/workflows/f335ee7c6e9144709ca9805787a1dc82/triggers/Telemetry_Received/paths/invoke?api-version=2016-10-01&sp=%2Ftriggers%2FTelemetry_Received%2Frun&sv=1.0&sig=zRUQT9XGkm7MXAounTQxvbVa6WGdQGJI8YkvjEkv2mQ",
                        "method": "POST",
                        "body": "@body('Get_Telemetry_Data')?['value']"
                      },
                      "runtimeConfiguration": {
                        "contentTransfer": {
                          "transferMode": "Chunked"
                        }
                      }
                    }
                  },
                  "outputs": {}
                },
                "parameters": {
                  "$connections": {
                    "value": {
                      "azuremonitorlogs": {
                        "id": "[format('/subscriptions/{0}/providers/Microsoft.Web/locations/{1}/managedApis/azuremonitorlogs', subscription().subscriptionId, parameters('location'))]",
                        "connectionId": "[resourceId('Microsoft.Web/connections', variables('azureSentinelConnectionName'))]",
                        "connectionName": "azuremonitorlogs",
                        "connectionProperties": {
                          "authentication": {
                            "type": "ManagedServiceIdentity",
                            "identity": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('uamiName'))]"
                          }
                        }
                      }
                    }
                  }
                }
              },
              "dependsOn": [
                "[resourceId('Microsoft.Web/connections', variables('azureSentinelConnectionName'))]",
                "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('uamiName'))]"
              ]
            },
            {
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "name": "[guid(resourceId('Microsoft.Logic/workflows', variables('laName')), resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('uamiName')), subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitionSentinelReaderId')))]",
              "properties": {
                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitionSentinelReaderId'))]",
                "principalId": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('uamiName')), '2024-11-30').principalId]",
                "principalType": "ServicePrincipal"
              },
              "dependsOn": [
                "[resourceId('Microsoft.Logic/workflows', variables('laName'))]",
                "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('uamiName'))]"
              ]
            }
          ]
        }
      }
    }
  ]
}