Azure Logic Apps/Microsoft Sentinel Playbooks are a great beneficiary of the capabilities of elastic compute and uses the power of the Azure Cloud platform to automatically scale and meet demand. You do not have to worry about the complexity of infrastructure capacity, hosting, maintenance, or availability for your workflows. Playbooks help automate and orchestrate response actions that would typically be undertaken by security analysts to better control incidents. These can be triggered manually or set to run automatically when specific alerts are triggered.
Problem Statement
Despite the very visual, no-code aspect of Logic Apps, the business logic and connections contained within a Logic App/Playbook will be recorded as JSON. This JSON contains organizational information such as tenant ID, subscription information, connection strings, and other items that make sharing a Playbook a potential security risk.
Unlike, for example, Workbooks, where you can simply copy and paste the JSON code, you can’t quickly deploy a Microsoft Sentinel Playbook due to the litany of tenant-specific information and Logic App connector dependencies contained in the code. There are instructions for sanitizing or templatizing a Playbook to remove the organization-specific information to make it shareable, but it takes some effort and time to accomplish, making it almost unattainable and in most cases not worthwhile.
In this blog post we’ll introduce you to a PowerShell utility that can enable you to quickly and easily export Azure Logic Apps/Playbooks as Azure Resource Manager (ARM) templates so that you can set up and automate deployments across multiple environments in the quickest amount of time.
Solution: Azure Logic App/Playbook ARM Template Generator
Creating ARM template for distribution is no longer a daunting technical challenge. This PowerShell utility first evaluates your Logic App and any connections that the Logic App uses then generates template resources with the necessary parameters for deployment. You can use this ARM template for your own business scenarios or customize the template to meet your requirements. You can share it safely knowing that your organization’s information is stripped from the code and that it will work correctly in the recipient environment.
For example, suppose you built a logic app/playbook for Microsoft Sentinel which enables the SecOps team to automate incident response workflows. This tool preserves all the orchestration logic and parameterizes the API connection strings so that you can provide and change those values based on your deployment needs.
Deployment
- Download Azure Logic App/Playbook ARM Template Generator tool from Azure Sentinel GitHub repository
- Extract the folder and open "Playbook_ARM_Template_Generator.ps1" in Visual Studio Code/PowerShell.
Note
The script runs from the user's machine. You must allow PowerShell script execution. To do so, run the following command:
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
- The script will prompt you to enter Azure Tenant Id.
- The script then prompts you to authenticate with credentials, once the user is authenticated, it prompts you to choose:
- Subscription
- Playbooks
- After selecting playbooks, the script prompts you to select a location on your machine to save ARM Template
Testing
You can deploy your ARM template in different ways, for more information please click here.
Demo
Summary
This post outlines the key components that are necessary to create ARM Templates for Azure Logic Apps/Playbooks for easier distribution. Try it out and let us know what you think! If you run into any issues, please create issue\PR in Azure Sentinel GitHub Repo.
We hope you find this article useful. Please leave us your feedback and questions in the comments section.
Special thanks to @Javier Soriano @Rod Trent for reviewing and providing feedback on article
Posted at https://sl.advdat.com/3vGLGTghttps://sl.advdat.com/3vGLGTg