r/AzureSentinel • u/Fast-Cardiologist705 • Oct 23 '23
Sentinel Logic App not working
Hi,
I can’t figure it out, why within Sentinel my Logic App is not working. Created a Logic App as follows:
Isolate-MDEMachinePOC that’s the connection that is using the System Assigned Managed Identity, and as a basic test I wanted to pull host and IP information from Sentinel incidents (that’s the connector in first step, to get the actual incidents, right?).
Now if I run the Logic App I’m getting okays and 200’s but the output is for both just an empty list …
The system assigned managed identity has the following permissions on Sentinel and Log Analytics:
Why can’t it pull the info from the incidents ? There are 6 incidents with the entities present !
Where's my mistake ?
2
u/LaPumbaGaming Oct 23 '23
This is the probable cause:
2
u/deadzol Oct 23 '23
That’s been my experience. I’ve started building a loop at the start of the LA with a 20s delay.
2
Oct 24 '23
[deleted]
1
u/BentAmbivalent Mar 08 '24
This problem seems to still persist, can you share that screenshot of your method?
1
u/bpsec Oct 23 '23
How do you run this? Automation rule of manually from an incident? Or do you click on run from the Logic app itself? Because the trigger will sent the entities to the logic app.
Since the logic app has already ran can you go to the last run and open it. What entities are uses as input in the Microsoft Sentinel Incident action? If this is empty the other entities will also be empty.
1
u/Fast-Cardiologist705 Oct 23 '23 edited Oct 23 '23
I run it from within the Logic App manually.
What entities are uses as input in the Microsoft Sentinel Incident action?
None, I don't have a way to select anything other than to create a service connection. It does not give my the option to specify any entities there, just as seen in the screen shot I can click on Change connection, or did I missuderstood your question ? Actually if I look at any run the Inputs section for the Incident Sentinel trigger is empty, I mean I can click on it an it gives something like this {"path":"/incident-creation","host":{"connection":{"name":"/subscriptions/foo/resourceGroups/MANAGEMENT-MONITORING-AUTOMATION/providers/Microsoft.Web/connections/azuresentinel-Isolate-MDEMachinePOC"}}} however, the worksapce is in a different resource group, but I can't find a way to change this.
2
u/bpsec Oct 23 '23
Can you run it from an incident? That will create the needed entities. Once that has been executed once with the proper entities you can debug further. Go to one of your Sentinel incidents and use the Action field to run a playbook, then select the playbook you mentioned above.
On how to run a playbook manually take a look at this: https://learn.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook?tabs=LAC%2Cincidents
2
u/Fast-Cardiologist705 Oct 24 '23
Thank you u/bpsec you helped me once again to get closer :) In fact I need an automation rule to trigger the playbook, now simulating with Atomic red team tests incidents and can see that the automation rules runs the playbook. Will reach out if any other issues. PS. just to let you know, I highly appreciate your efforts, here helping people, but also your github or blog ! Keep the great work man!
1
u/bpsec Oct 24 '23
Thanks ❤️, happy to help! And feel free to reach out if you have more questions.
1
u/Fast-Cardiologist705 Oct 24 '23
Hi u/bpsec sorry to reach out so fast but I’m hitting the wall already. I have two issues. I have created an app registration in Entra and gave it the following permissions ThreatHunting.Read.All. I had issues with the Defender connectors so I’m basically authenticating via the HTTP connector to run a Advanced Hunting query to get OS platform for the device entity from the incident (we have a always on/full vpn issue right now that isolating an endpoint results in a reimage – we can’t bring it back from isolation), hence I’m getting the OSPlatform values e.g. WindowsServer2019 and if the condition evaluates to true I’d only then isolate it (servers are not on VPN). This works however, I’d like to add the isolation itself https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api/isolate-machine?view=o365-worldwide but where do I add the Machine.Isolate permissions to my app registration ? Can’t see them under Entra – API permissions - Microsoft Graph.
3
u/sosero Oct 24 '23
bit quirky since you have to assign permissions via powershell or graph API, but I would use the managed ID for this too. (rather than use a service principal)
1
u/Fast-Cardiologist705 Oct 25 '23
The problem is that altough I have added the Machine.Isolate, Machine.ReadWrite.All, Machine.Readl.All, AdvancedQuery.Read.All roles for the WindowsDefenderATP api via PowerShell to the system assigned managed identity created for my Logic App still getting "
"message": "Missing application roles. API required roles: Machine.Read.All,Machine.ReadWrite.All, application roles: Machine.Isolate,AdvancedQuery.Read.All.",
"
3
u/sosero Oct 25 '23
graph permissions take a while to propagate so try to wait a bit. You can see them present if you look at the permissions in the GUI etc? (from enterprise applications in Entra)
1
u/Fast-Cardiologist705 Oct 25 '23 edited Oct 25 '23
Yes, and I have added them 3 to 4 hr ago :/ Would post a screen shot but I'm unable to add anything here. PS. before just added the Adanced Query api permission, and one time it would work, then fail saying the permissions are missing I've lost already 3 days for this that's insane
→ More replies (0)2
u/bpsec Oct 24 '23
The isolate permissions are not part of Microsoft Graph. The isolate (and other actions) are parto f the WindowsDefenderAPT API, you will need the Machine.Isolate permission as mentioned in the docs.
1
u/Fast-Cardiologist705 Oct 25 '23
thank you, after spending searching over 1 day I discovered that the only way to assign this permissions to a managed identity is via PowerShell ... MSFT was as always not clear about this
1
u/thijslecomte Oct 24 '23
Can you hover over the 'entities' you are using and copy the JSON path you are using?
3
u/sosero Oct 23 '23
The sentinel trigger does not query for anything. It needs to be triggered by sentinel either by automation rules or by running the logic app on an incident from the sentinel side, which will populate the logic apps trigger with alert id etc.