# Azure Sentinel

## Introduction

This guide explains how to trigger Mindflow after creating a rule. Two methods are presented: via subscription to a rule and using a playbook to automate the process.

## 1. Triggering Mindflow via Subscription to a Rule for each alert

:::note
This method gives you the granularity to be informed for each alert. The subscription playbook can therefore be triggered many times. However, an incident can be created in order to correlate several alerts with the same attack techniques or the same attacker to provide a broader context of an attack. **This method does not allow you to be informed when an incident is created.**
:::

### Step 1: Create an App Registration with the Correct Permissions

| SecurityActions.Read.All       |
| ------------------------------ |
| SecurityActions.ReadWrite.All  |
| SecurityAlert.Read.All         |
| SecurityAlert.ReadWrite.All    |
| SecurityEvents.Read.All        |
| SecurityEvents.ReadWrite.All   |
| SecurityIncident.Read.All      |
| SecurityIncident.ReadWrite.All |

:::note

## Do not forget to validate the admin consent

:::

   <div class="docs-screenshot-compact">

   ![Do not forget validate admin consent](./assets/do-not-forget-validate-admin-consent.png)

   </div>

### Step 2: Configure Authentication in Mindflow

- Retrieve the **client ID** and **Secret**.
- Create a **credential** in Mindflow using this information.

  <div class="docs-screenshot-compact">

  ![Create credential mindflow using information](./assets/create-credential-mindflow-using-information.png)

  </div>

### Step 3: Create the main playbook to Respond to Incidents

- First of all, add a **token validation branch** at the beginning of the main playbook to validate the `validationToken` when creating the subscription.

  <div class="docs-screenshot-compact">

  ![First all add token validation branch](./assets/first-all-add-token-validation-branch.png)

  </div>

  At the time of subscription creation, Microsoft sends a request to the main playbook to validate the token. Therefore, a branch needs to be implemented to handle this case.

  ### Step 4: Set Up a Playbook for Subscription Renewal

  - The maximum duration of a subscription is **30 days**.
  - Create a playbook that runs at regular intervals to renew the subscription.
  - Use the **Create a Subscription** operation with the following parameters:

  <div class="docs-screenshot-compact">

  ![Use create subscription operation following](./assets/use-create-subscription-operation-following.png)

  </div>
  - **Change Type**: `updated`
  - **Expiration date time**:

  <div class="docs-screenshot-compact">

  ![Expiration date time](./assets/expiration-date-time.png)

  </div>
  - **Notification URL**: synchronous URL of the main playbook
  - **Resource**: `security/alerts/?$filter=status eq 'newAlert'`

:::note
This resource allows you to be informed of each new alert, but it is also possible to filter according to title or category.

- /security/alerts?$filter=category eq 'ransomware'
- /security/alerts?$filter=title eq 'Suspicious Activity'

:::

```text
### Step 5: Handle New Alerts via Webhook

- Once the subscription is created, each new alert generates a **webhook request**.
- This request contains a **unique incident ID**.

   <div class="docs-screenshot-compact">

   ![Request contains unique incident id](./assets/request-contains-unique-incident-id.png)

   </div>

- Use the **Get Alert** operation to retrieve all the alert properties.
```

   <div class="docs-screenshot-compact">

   ![Use get alert operation retrieve all](./assets/use-get-alert-operation-retrieve-all.png)

   </div>

## 2. Triggering Mindflow for every incident

In the example, we will send all **incidents** to automation, but it is possible to create rules that tag incidents based on their incident type and filter alerts through a condition to determine which ones will trigger automation.

### 1. Via LogicApps by Creating an Automation rule

### Step 1: Set Up a Stateful Workflow in Logic Apps

- First of all, you must create a stateful workflow, then use **Microsoft Sentinel Incident** as a trigger. (_cf screenshot)_

  <div class="docs-screenshot-compact">

  ![First all you must create stateful](./assets/first-all-you-must-create-stateful.png)

  </div>

### Step 2: Grant Permissions in Sentinel Automation

- Select the **subscription** of your Logic App Workflow and grant the required permissions.

   <div class="docs-screenshot-compact">

   ![Select subscription your logic app workflow](./assets/select-subscription-your-logic-app-workflow.png)

   </div>

- Then set up automation for the workflow.

  <div class="docs-screenshot-compact">

  ![Then set up automation workflow](./assets/then-set-up-automation-workflow.png)

  </div>

### Step 3: Configure Mindflow Integration

- Ensure synchronization to use the **Webhook response** step since LogicApps expects JSON in return, whereas Mindflow sends text by default.

  <div class="docs-screenshot-compact">

  ![Ensure synchronization use webhook response step](./assets/ensure-synchronization-use-webhook-response-step.png)

  </div>

- Once an **incident is created** (either automatically via a rule or manually), the workflow will handle it accordingly. (_cf screenshot_)

   <div class="docs-screenshot-compact">

   ![Once incident created either automatically via](./assets/once-incident-created-either-automatically-via.png)

   </div>

### 2. Via Mindflow playbook

:::note
From Mindflow, you can create a playbook that will run at regular intervals (via the scheduler) in order to continuously retrieve new incidents from sentinel.
:::

   <div class="docs-screenshot-compact">

   ![Once incident created either automatically via](./assets/once-incident-created-either-automatically-via-2.png)

   </div>

To retrieve the list of incidents, you need to create a new credential in Mindflow with the OAuth 2.0 Authorization Code authentication type.

   <div class="docs-screenshot-compact">

   ![Once incident created either automatically via](./assets/once-incident-created-either-automatically-via-3.png)

   </div>

On Microsoft side, the application requires the following list of permissions.

   <div class="docs-screenshot-compact">

   ![Once incident created either automatically via](./assets/once-incident-created-either-automatically-via-4.png)

   </div>

- Once an **incident is created** (either automatically via a rule or manually), the sub-workflow will handle it accordingly. (_cf screenshot_)

   <div class="docs-screenshot-compact">

   ![Once incident created either automatically via](./assets/once-incident-created-either-automatically-via.png)

   </div>