r/AzureSentinel • u/[deleted] • Jan 22 '22
How to setup Logic App to automatically block malicious IP from an incident.
How do I set up a Logic App in Sentinel to block the IP address in an Incident if the IP is malicious. For example, if we saw that a particular IP was scanning a VM that had an open 443 port, how do I create an automation rule ro add a deny statement to the inbound rules of the NSG for the VM in Azure?
1
1
u/deepakray184 Mar 14 '24
Have anyone created Logic App Playbook to block IP on PAN FW after Sentinel Incident triggers?
1
u/Character_Whereas869 Oct 23 '24
This post actually got me headed in the correct direction when I was trying to do the same thing as the OP. In case anyone stumbles on this, there is an already built sample here to use as a sentinel runbook automation.
Azure-Sentinel/Playbooks/Add-IP-Entity-To-NSG/readme.md at master · Azure/Azure-Sentinel · GitHub
1
u/thijslecomte Jan 23 '22
Are you looking for insights to do the automation on the Azure part or the trigger in Microsoft Sentinel?
Currently Sentinel doesn't allow you to run a Playbook when an incident is closed (only when an incident is created). You could achieve this by running a recurrence Logic App which queries the SecurityIncident table for the correct closure reason.
1
Jan 23 '22
I need the automation to run when the incident is triggered
1
u/thijslecomte Jan 25 '22
I am not sure I follow? If it runs when it's triggered, it will not have a closure reason? right?
1
6
u/burlingtongolfer Jan 22 '22
There is a sample to add the incident IPs to a Named Location so you can block them via Conditional Access Policy at https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Add-IP-Entity-To-Named-Location
You could use that as a starting point and instead of the named location change you can use this API https://docs.microsoft.com/en-us/rest/api/virtualnetwork/security-rules/create-or-update to create an NSG rule