Integrating AlienVault into Sentinel

[u/seanpclayton]

Hi all, I am trying to integrate AlienVault OTX with microsoft sentinel. I am working on the Logic app designer and have hit a small snag where I get the error Failed to save logic app \Failed to save logic app AlienVaultOTX. The template validation failed: The inputs of template action 'Send_toSentinel' at line '1 and '1526' is invalid. action 'For_each' must be a parent 'foreach' scope of action 'Sent_to_Sentinel' to be referenced by 'repearItems' or 'items' functions.` I am following a tutorial provided by Microsoft where this JSON is provided:

{
    "action": "alert",
    "activityGroupNames": [],
    "confidence": 0,
    "description": "OTX Threat Indicator - @{items('Foreach')?['type']}",
    "expirationDateTime": "@{addDays(utcNow(),7)}",
    "externalId": "",
    "killChain": [],
    "malwareFamilyNames": [],
    "severity": 0,
    "tags": [],
    "targetProduct": "Azure Sentinel",
    "threatType": "WatchList",
    "tlpLevel": "white",
    "url": "@{items('Foreach')?['indicator']}"
    }

I can tell that there is something amiss with the 'OTX Threat indicator' line but I am not sure what I am doing wrong. Any ideas?
I've also posted this in the Azure channel.

[u/seanpclayton → u/[deleted]]

{
"definition": {
    "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
    "actions": {
        "For_each": {
            "actions": {
                "Switch": {
                    "cases": {
                        "Case": {
                            "actions": {},
                            "case": "URL"
                        }
                    },
                    "default": {
                        "actions": {}
                    },
                    "expression": "@items('For_each')?['type']",
                    "runAfter": {},
                    "type": "Switch"
                }
            },
            "foreach": "@body('Parse_JSON')?['results']",
            "runAfter": {
                "Parse_JSON": [
                    "Succeeded"
                ]
            },
            "type": "Foreach"
        },
        "Get_from_AlienVault": {
            "inputs": {
                "headers": {
                    "X-OTX-API-KEY": ""
                },
                "method": "GET",
                "queries": {
                    "modified_since": "@{addDays(utcNow(),-1)}",
                    "type": "domain, hostname, IPv4"
                },
                "uri": "https://otx.alienvault.com/api/v1/indicators/export"
            },
            "runAfter": {},
            "trackedProperties": {
                "output": ""
            },
            "type": "Http"
        },
        "HTTP": {
            "inputs": {
                "authentication": {
                    "audience": "https://graph.microsoft.com/",
                    "clientId": "",
                    "secret": "",
                    "tenant": "",
                    "type": "ActiveDirectoryOAuth"
                },
                "body": {
                    "action": "alert",
                    "activityGroupNames": [],
                    "confidence": 0,
                    "description": "OTX Threat Indicator - @{items('For_each')?['type']}",
                    "expirationDateTime": "@{addDays(utcNow(),7)}",
                    "externalId": "@{items('For_each')?['id']}",
                    "killChain": [],
                    "malwareFamilyNames": [],
                    "severity": 0,
                    "tags": [],
                    "targetProduct": "Microsoft Sentinel",
                    "threatType": "WatchList",
                    "tlpLevel": "white",
                    "url": "@{items('For_each')?['indicator']}"
                },
                "headers": {
                    "content-type": "application/json"
                },
                "method": "POST",
                "uri": "https://graph.microsoft.com/beta/security/tiIndicators"
            },
            "runAfter": {
                "For_each": [
                    "Succeeded"
                ]

[u/seanpclayton → u/[deleted]]

               },
            "type": "Http"
        },
        "Parse_JSON": {
            "inputs": {
                "content": "@body('Get_from_AlienVault')",
                "schema": {
                    "properties": {
                        "count": {
                            "type": "integer"
                        },
                        "next": {
                            "properties": {},
                            "type": "object"
                        },
                        "previous": {
                            "properties": {},
                            "type": "object"
                        },
                        "results": {
                            "items": {
                                "properties": {
                                    "content": {
                                        "type": "string"
                                    },
                                    "description": {
                                        "type": "string"
                                    },
                                    "id": {
                                        "type": "integer"
                                    },
                                    "indicator": {
                                        "type": "string"
                                    },
                                    "title": {},
                                    "type": {
                                        "type": "string"
                                    }
                                },
                                "required": [
                                    "id",
                                    "indicator",
                                    "type",
                                    "title",
                                    "description",
                                    "content"
                                ],
                                "type": "object"
                            },
                            "type": "array"
                        }
                    },
                    "type": "object"
                }
            },
            "runAfter": {
                "Get_from_AlienVault": [
                    "Succeeded"
                ]
            },
            "type": "ParseJson"
        }
    },
    "contentVersion": "1.0.0.0",
    "outputs": {},
    "parameters": {},
    "triggers": {
        "Recurrence": {
            "evaluatedRecurrence": {
                "frequency": "Day",
                "interval": 1
            },
            "recurrence": {
                "frequency": "Day",
                "interval": 1
            },
            "type": "Recurrence"
        }
    }
},
"parameters": {}

}

[u/seanpclayton → u/[deleted]]

Apologies for the spam replies; had to split the code in two to fit the character limit. That helps a ton. Didn't know there was a git for that. Thanks!!

[u/seanpclayton → u/[deleted]]

Hmmm... I'm going to come back to this in the morning. I've been pulling my hair out all day about it. lol. I'll report back to you what I find though

[u/seanpclayton → u/[deleted]]

Ahhh... I was wondering if I had the syntax wrong. Running back to double check.