feat: add Playbooks/Enrich-AzureResourceGraph

[juju4]

Change(s):

• add Playbooks/Enrich-AzureResourceGraph

Reason for Change(s): This LogicApp is querying Azure ResourceGraph and return typical azure information related to the resource like subscription, resourcegroup, tags and management groups. It is encapsulated in other Logic app to enrich Sentinel incident (like Enrich-AzureResourceGraph-Incident).

Testing Completed:

• Yes. used in production for many months

Checked that the validations are passing and have addressed any issues that are present:

• Yes. Deployed in production with Sentinel Repository feature, precommit and psrule

[v-rbajaj]

Hi @juju4, can you please address @rahul0216's comment?

[v-rbajaj]

Hi @juju4, can you please address @rahul0216's comment?

[juju4]

ARM template prerequisites has

"1. Set service principal with Reader role to query resourcegraph.\n2. Set keyvault to store client id and secret.\n3. Pass those parameters at deployment time."

Readme had

• Service principal client id and secret stored in Azure keyvault (Possible change to Managed Identity as supported by HTTP block)

Slightly edited the later to add expected keyvault secret names.

Please withold on merge as I'm reviewing playbook to have resourcegraph as a an optional playbook parameter.

[rahul0216]

@juju4 I'll wait for your confirmation before approving this PR, as you may have some changes.

[v-rbajaj]

Hi @juju4, waiting for confirmation from your side.

[v-rbajaj]

Hi @juju4, can you please provide confirmation?

[juju4]

Please give me one or two weeks to work on testing.

[v-atulyadav]

Hi @juju4, thanks for acknowledging.

[juju4]

Code and docs update but as per support delay, I won't be able to test until an extra week. So probably 2 weeks more before giving go.

[v-rbajaj]

@juju4, Thanks for updating us.

[v-rbajaj]

Hi @juju4, is there any update on this PR?

[juju4]

updated pushed. Thanks for your patience.

[v-atulyadav]

Hi @juju4, please act on @rahul0216's comments. Thanks

[rahul0216]

Playbook deployment is failing with following error when there is no tenant id provided,

[juju4]

Fixed but that means Playbooks/Notify-ASCAlertAzureResource/azuredeploy.json is likely broken as it was following same parameter model.

[juju4]

Last update deploys fine but is not functional. Tenant parameter not replaced in url path. I wonder if there is a recommended way to handle that or a working model template unlike Playbooks/Notify-ASCAlertAzureResource

[rahul0216]

@juju4 parameter values are replaced during execution. Did you run the playbook and test after update? You can refer this playbook, https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Australian%20Cyber%20Security%20Centre/Playbooks/AusCtisExportTaggedIndicators/azuredeploy.json

It is not exact scenario but it may give you an idea how parameters are used in logic app. Also, Please attach a screenshot of successful run once you have one.

[v-rbajaj]

Hi @juju4, please look into Rahul's comment, please work on the requested changes.

[v-rbajaj]

Hi @juju4, please look into Rahul's comment and act on it accordingly.

[v-rbajaj]

Hi @juju4, waiting for some update from you on this PR

[v-rbajaj]

Hi @juju4, please act on this PR.

[v-rbajaj]

Hi @juju4, hope you are doing well. Just wanted to check if you got a chance to look at the suggestions/feedback shared. Please feel free to reach out to us for any queries and/or support.

[juju4]

fix for tenantid done. tested in deployment pipeline and run. should be good for merge.

[rahul0216]

@juju4 Thanks for the updates. These looks good. Can you please share screenshot of a successful run?

[juju4]

Here are some screenshots