├── Convert-html-content-to-json-string.ps1
├── readme.md
├── logicapp-enrich-incident-virustotal-ip-comment.html
├── logicapp-enrich-incident-virustotal-filehash-comment.html
└── logicapp-enrich-incident-virustotal.template.json


/Convert-html-content-to-json-string.ps1:
--------------------------------------------------------------------------------
1 | $jsonString = (Get-Content ./logicapp-enrich-incident-virustotal-filehash-comment.html -Raw) -replace "`r`n" | ConvertTo-Json
2 | Write-Host $jsonString


--------------------------------------------------------------------------------
/readme.md:
--------------------------------------------------------------------------------
 1 | # Introduction
 2 | 
 3 | **This repository is referred to by one of my articles on Medium**
 4 | 
 5 | > Once a security incident is raised, and triage begins, our security analysts often take very similar steps during their investigations.
 6 | 
 7 | > Automation might be able to help to shorten investigations, bring down ‘alert fatigue’ and in turn make sure your analysts have more time to make your organization even safer.
 8 | 
 9 | > In this article I’ll demonstrate how to leverage VirusTotal’s services to automatically scan all of your file hashes and IP addresses that come through Microsoft Sentinel as entities in their respective incidents. The scan results are then automatically attached to the security incidents so that your analysts see the reputation and other details in an instant, without having to go out and retrieve this information themselves.
10 | 
11 | https://medium.com/@koosg/automate-your-sentinel-incident-triage-a316d229f2fc
12 | 
13 | <br>
14 | 
15 | # Contents
16 | 
17 | ### logicapp-enrich-incident-virustotal.template.json
18 | 
19 | This is the ARM template you can use to deploy the Logic App used as an example in the article.
20 | 
21 | To deploy this playbook, click the button below. After deployment you still need to fix the Sentinel and VirusTotal steps and create a new connection for them with your own settings/API key.
22 | 
23 | <br>
24 | 
25 | [![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FTheCloudScout%2Fincident-enrich-virustotal%2Fmain%2Flogicapp-enrich-incident-virustotal.template.json)
26 | 
27 | <br>
28 | 
29 | ### logicapp-enrich-incident-virustotal-filehash-comment.html
30 | 
31 | This is the unaltered html code used to construct the Sentinel comment for file hash(es) reports.
32 | 
33 | ### logicapp-enrich-incident-virustotal-ip-comment.html
34 | 
35 | This is the unaltered html code used to construct the Sentinel comment for IP reports.
36 | 
37 | ### Convert-html-content-to-json-string.ps1
38 | 
39 | An example PowerShell commandline to convert the contents of an html file into a proper JSON formated single string to put into the `message` value of your playbook.


--------------------------------------------------------------------------------
/logicapp-enrich-incident-virustotal-ip-comment.html:
--------------------------------------------------------------------------------
 1 | ![alt text](https://vt-gtm-wp-media.storage.googleapis.com/logo.png 'VirusTotal')
 2 | <h2>IP address: @{body('VirusTotal_|_IP_scan_report')?['data']?['id']}</h2>
 3 | </hr>
 4 | <h3>Detection</h3>
 5 | <table>
 6 | 	<tr>
 7 | 		<th>Harmless</th>
 8 | 		<th>Malicious</th>
 9 | 		<th>Suspicious</th>
10 | 		<th>Undetected</th>
11 | 	</tr>
12 | 	<tr>
13 | 		<td style="text-align: center">@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['last_analysis_stats']?['harmless']}</td>
14 | 		<td style="text-align: center">@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['last_analysis_stats']?['malicious']}</td>
15 | 		<td style="text-align: center">@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['last_analysis_stats']?['suspicious']}</td>
16 | 		<td style="text-align: center">@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['last_analysis_stats']?['undetected']}</td>
17 | 	</tr>
18 | </table>
19 | <ul>
20 | 	<li>&#39;harmless&#39; : site is not malicious</li>
21 | 	<li>&#39;undetected&#39; : scanner has no opinion about this site</li>
22 | 	<li>&#39;suspicious&#39; : scanner thinks the site is suspicious</li>
23 | 	<li>&#39;malicious&#39; : scanner thinks the site is malicious</li>
24 | </ul>
25 | <h3>Community Score</h3>
26 | <table>
27 | 	<tr>
28 | 		<th>Malicious</th>
29 | 		<th>Harmless</th>
30 | 	</tr>
31 | 	<tr>
32 | 		<td style="text-align: center">@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['total_votes']?['malicious']}</td>
33 | 		<td style="text-align: center">@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['total_votes']?['harmless']}</td>
34 | 	</tr>
35 | </table>
36 | <h3>Details</h3>
37 | <table>
38 | 	<tr>
39 | 		<th>Network</th>
40 | 		<td>@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['network']}</td>
41 | 	</tr>
42 | 	<tr>
43 | 		<th>ASN Number</th>
44 | 		<td>@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['asn']}</td>
45 | 	</tr>
46 | 	<tr>
47 | 		<th>ASN Label</th>
48 | 		<td>@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['as_owner']}</td>
49 | 	</tr>
50 | 	<tr>
51 | 		<th>Regional Internet Registry</th>
52 | 		<td>@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['regional_internet_registry']}</td>
53 | 	</tr>
54 | 	<tr>
55 | 		<th>Country</th>
56 | 		<td>@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['country']}</td>
57 | 	</tr>
58 | 	<tr>
59 | 		<th>Continent</th>
60 | 		<td>@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['continent']}</td>
61 | 	</tr>
62 | </table>
63 | [Full report](https://www.virustotal.com/gui/ip-address/@{body('VirusTotal_|_IP_scan_report')?['data']?['id']})


--------------------------------------------------------------------------------
/logicapp-enrich-incident-virustotal-filehash-comment.html:
--------------------------------------------------------------------------------
  1 | ![alt text](https://vt-gtm-wp-media.storage.googleapis.com/logo.png 'VirusTotal')
  2 | <h2>File: @{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['meaningful_name']} - @{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['id']}</h2>
  3 | <hr/>
  4 | <h3>Detection</h3>
  5 | 
  6 | @{if(contains(body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes'],'sigma_analysis_stats'),concat('
  7 | <h4>Crowdsourced Sigma Rules</h4>
  8 | <table>
  9 | 	<tr>
 10 | 		<th>Critical</th>
 11 | 		<th>High</th>
 12 | 		<th>Medium</th>
 13 | 		<th>Low</th>
 14 | 	</tr>
 15 | 	<tr>
 16 | 		<td style="text-align:center">',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['sigma_analysis_stats']?['critical'],'</td>
 17 | 		<td style="text-align:center">',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['sigma_analysis_stats']?['high'],'</td>
 18 | 		<td style="text-align:center">',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['sigma_analysis_stats']?['medium'],'</td>
 19 | 		<td style="text-align:center">',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['sigma_analysis_stats']?['low'],'</td>
 20 | 	</tr>
 21 | </table>
 22 | '),null)}
 23 | 
 24 | @{if(contains(body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes'],'crowdsourced_ids_stats'),concat('
 25 | <h4>Crowdsourced IDS Rules</h4>
 26 | <table>
 27 | 	<tr>
 28 | 		<th>High</th>
 29 | 		<th>Medium</th>
 30 | 		<th>Low</th>
 31 | 		<th>Info</th>
 32 | 	</tr>
 33 | 	<tr>
 34 | 		<td style="text-align:center">',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['crowdsourced_ids_stats']?['high'],'</td>
 35 | 		<td style="text-align:center">',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['crowdsourced_ids_stats']?['medium'],'</td>
 36 | 		<td style="text-align:center">',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['crowdsourced_ids_stats']?['low'],'</td>
 37 | 		<td style="text-align:center">',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['crowdsourced_ids_stats']?['info'],'</td>
 38 | 	</tr>
 39 | </table>
 40 | '),null)}
 41 | 
 42 | <h4>Analyses</h4>
 43 | <table>
 44 | 	<tr>
 45 | 		<th>Harmless</th>
 46 | 		<th>Malicious</th>
 47 | 		<th>Suspicious</th>
 48 | 		<th>Undetected</th>
 49 | 	</tr>
 50 | 	<tr>
 51 | 		<td style='text-align:center'>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['last_analysis_stats']?['harmless']}</td>
 52 | 		<td style='text-align:center'>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['last_analysis_stats']?['malicious']}</td>
 53 | 		<td style='text-align:center'>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['last_analysis_stats']?['suspicious']}</td>
 54 | 		<td style='text-align:center'>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['last_analysis_stats']?['undetected']}</td>
 55 | 	</tr>
 56 | </table>
 57 | 
 58 | <h3>Community Score</h3>
 59 | <table>
 60 | 	<tr>
 61 | 		<th>Malicious</th>
 62 | 		<th>Harmless</th>
 63 | 	</tr>
 64 | 	<tr>
 65 | 		<td style='text-align:center'>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['total_votes']?['malicious']}</td>
 66 | 		<td style='text-align:center'>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['total_votes']?['harmless']}</td>
 67 | 	</tr>
 68 | </table>
 69 | 
 70 | <h3>Details</h3>
 71 | <h4>Basic Properties</h4>
 72 | <table>
 73 | 	<tr>
 74 | 		<th>MD5</th>
 75 | 		<td>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['md5']}</td>
 76 | 	</tr>
 77 | 	<tr>
 78 | 		<th>SHA-1</th>
 79 | 		<td>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['sha1']}</td>
 80 | 	</tr>
 81 | 	<tr>
 82 | 		<th>SHA-256</th>
 83 | 		<td>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['sha256']}</td>
 84 | 	</tr>
 85 | 	<tr>
 86 | 		<th>File type</th>
 87 | 		<td>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['type_description']}</td>
 88 | 	</tr>
 89 | 	<tr>
 90 | 		<th>Magic</th>
 91 | 		<td>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['magic']}</td>
 92 | 	</tr>
 93 | 	<tr>
 94 | 		<th>File size</th>
 95 | 		<td>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['size']} bytes</td>
 96 | 	</tr>
 97 | </table>
 98 | 
 99 | <h4>History</h4>
100 | <table>
101 | @{if(contains(body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes'],'creation_date'),concat('
102 | 	<tr>
103 | 		<th>Creation Time</th>
104 | 		<td>',addToTime('1970-01-01T00:00:00Z',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['creation_date'],'Second','u'),'</td>
105 | 	</tr>
106 | '),null)}
107 | 	<tr>
108 | 		<th>First Submission</th>
109 | 		<td>@{addToTime('1970-01-01T00:00:00Z',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['first_submission_date'],'Second','u')}</td>
110 | 	</tr>
111 | 	<tr>
112 | 		<th>Last Submission</th>
113 | 		<td>@{addToTime('1970-01-01T00:00:00Z',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['last_submission_date'],'Second','u')}</td>
114 | 	</tr>
115 | 	<tr>
116 | 		<th>Last Analysis</th>
117 | 		<td>@{addToTime('1970-01-01T00:00:00Z',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['last_analysis_date'],'Second','u')}</td>
118 | 	</tr>
119 | @{if(contains(body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes'],'last_modification_date'),concat('
120 | 	<tr>
121 | 		<th>Latest Contents Modification</th>
122 | 		<td>',addToTime('1970-01-01T00:00:00Z',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['last_modification_date'],'Second','u'),'</td>
123 | 	</tr>
124 | '),null)}
125 | </table>
126 | 
127 | @{if(contains(body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes'],'trusted_verdict'),concat('
128 | <h4>Known source</h4>
129 | <table>
130 | 	<tr>
131 | 		<th>Organization</th>
132 | 		<td>',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['trusted_verdict']?['organization'],'</td>
133 | 	</tr>
134 | 	<tr>
135 | 		<th>File name</th>
136 | 		<td>',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['trusted_verdict']?['filename'],'</td>
137 | 	</tr>
138 | </table>
139 | '),null)}
140 | 
141 | @{if(contains(body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes'],'signature_info'),concat(
142 | '<h4>Signature Info</h4>
143 | <table>
144 | 	<tr>
145 | 		<th>Signature verifiation</th>
146 | 		<td>',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['signature_info']?['verified'],'</td>
147 | 	</tr>
148 | 	<tr>
149 | 		<th>Copyright</th>
150 | 		<td>',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['signature_info']?['copyright'],'</td>
151 | 	</tr>
152 | 	<tr>
153 | 		<th>Product</th>
154 | 		<td>',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['signature_info']?['product'],'</td>
155 | 	</tr>
156 | 	<tr>
157 | 		<th>Description</th>
158 | 		<td>',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['signature_info']?['description'],'</td>
159 | 	</tr>
160 | 	<tr>
161 | 		<th>Original Name</th>
162 | 		<td>',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['signature_info']?['original name'],'</td>
163 | 	</tr>
164 | 	<tr>
165 | 		<th>Internal Name</th>
166 | 		<td>',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['signature_info']?['internal name'],'</td>
167 | 	</tr>
168 | 	<tr>
169 | 		<th>File Version</th>
170 | 		<td>',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['signature_info']?['file version'],'</td>
171 | 	</tr>
172 | 	<tr>
173 | 		<th>Date signed</th>
174 | 		<td>',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['signature_info']?['signing date'],'</td>
175 | 	</tr>
176 | </table>
177 | '),null)}
178 | 
179 | [Full report](https://www.virustotal.com/gui/file/@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['id']})


--------------------------------------------------------------------------------
/logicapp-enrich-incident-virustotal.template.json:
--------------------------------------------------------------------------------
  1 | {
  2 |     "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  3 |     "contentVersion": "1.0.0.0",
  4 |     "parameters": {
  5 |         "playbook_name": {
  6 |             "defaultValue": "enrich-incident-virustotal",
  7 |             "type": "String"
  8 |         }
  9 |     },
 10 |     "resources": [
 11 |         {
 12 |             "type": "Microsoft.Web/connections",
 13 |             "apiVersion": "2016-06-01",
 14 |             "name": "api-connection-azuresentinel",
 15 |             "location": "[resourceGroup().location]",
 16 |             "kind": "V1",
 17 |             "properties": {
 18 |                 "displayName": "api-connection-azuresentinel",
 19 |                 "api": {
 20 |                     "name": "api-connection-azuresentinel",
 21 |                     "displayName": "Microsoft Sentinel",
 22 |                     "description": "Cloud-native SIEM with a built-in AI so you can focus on what matters most",
 23 |                     "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]",
 24 |                     "type": "Microsoft.Web/locations/managedApis"
 25 |                 }
 26 |             }
 27 |         },
 28 |         {
 29 |             "type": "Microsoft.Web/connections",
 30 |             "apiVersion": "2016-06-01",
 31 |             "name": "api-connection-virustotal",
 32 |             "location": "[resourceGroup().location]",
 33 |             "kind": "V1",
 34 |             "properties": {
 35 |                 "displayName": "api-connection-virustotal",
 36 |                 "api": {
 37 |                     "name": "api-connection-virustotal",
 38 |                     "displayName": "Virus Total",
 39 |                     "description": "Virus Total is an online service that analyzes suspicious files and URLs to detect types of malware and malicious content using antivirus engines and website scanners. It provides an API that allows users to access the information generated by VirusTotal.",
 40 |                     "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/virustotal')]",
 41 |                     "type": "Microsoft.Web/locations/managedApis"
 42 |                 }
 43 |             }
 44 |         },
 45 |         {
 46 |             "type": "Microsoft.Logic/workflows",
 47 |             "apiVersion": "2017-07-01",
 48 |             "name": "[parameters('playbook_name')]",
 49 |             "location": "[resourceGroup().location]",
 50 |             "dependsOn": [
 51 |                 "api-connection-azuresentinel",
 52 |                 "api-connection-virustotal"
 53 |             ],
 54 |             "properties": {
 55 |                 "state": "Enabled",
 56 |                 "definition": {
 57 |                     "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
 58 |                     "contentVersion": "1.0.0.0",
 59 |                     "parameters": {
 60 |                         "$connections": {
 61 |                             "defaultValue": {},
 62 |                             "type": "Object"
 63 |                         }
 64 |                     },
 65 |                     "triggers": {
 66 |                         "Microsoft_Sentinel_incident": {
 67 |                             "type": "ApiConnectionWebhook",
 68 |                             "inputs": {
 69 |                                 "body": {
 70 |                                     "callback_url": "@{listCallbackUrl()}"
 71 |                                 },
 72 |                                 "host": {
 73 |                                     "connection": {
 74 |                                         "name": "@parameters('$connections')['azuresentinel']['connectionId']"
 75 |                                     }
 76 |                                 },
 77 |                                 "path": "/incident-creation"
 78 |                             }
 79 |                         }
 80 |                     },
 81 |                     "actions": {
 82 |                         "Entities_-_Get_FileHashes": {
 83 |                             "runAfter": {
 84 |                                 "Entities_-_Get_IPs": [
 85 |                                     "Succeeded"
 86 |                                 ]
 87 |                             },
 88 |                             "type": "ApiConnection",
 89 |                             "inputs": {
 90 |                                 "body": "@triggerBody()?['object']?['properties']?['relatedEntities']",
 91 |                                 "host": {
 92 |                                     "connection": {
 93 |                                         "name": "@parameters('$connections')['azuresentinel']['connectionId']"
 94 |                                     }
 95 |                                 },
 96 |                                 "method": "post",
 97 |                                 "path": "/entities/filehash"
 98 |                             }
 99 |                         },
100 |                         "Entities_-_Get_IPs": {
101 |                             "runAfter": {},
102 |                             "type": "ApiConnection",
103 |                             "inputs": {
104 |                                 "body": "@triggerBody()?['object']?['properties']?['relatedEntities']",
105 |                                 "host": {
106 |                                     "connection": {
107 |                                         "name": "@parameters('$connections')['azuresentinel']['connectionId']"
108 |                                     }
109 |                                 },
110 |                                 "method": "post",
111 |                                 "path": "/entities/ip"
112 |                             }
113 |                         },
114 |                         "Initialize_array_|_reported_ids": {
115 |                             "runAfter": {
116 |                                 "Entities_-_Get_FileHashes": [
117 |                                     "Succeeded"
118 |                                 ]
119 |                             },
120 |                             "type": "InitializeVariable",
121 |                             "inputs": {
122 |                                 "variables": [
123 |                                     {
124 |                                         "name": "reported_ids",
125 |                                         "type": "array"
126 |                                     }
127 |                                 ]
128 |                             }
129 |                         },
130 |                         "Loop_through_all_IPs": {
131 |                             "foreach": "@body('Entities_-_Get_IPs')?['IPs']",
132 |                             "actions": {
133 |                                 "Add_comment_to_incident_(V3)": {
134 |                                     "runAfter": {
135 |                                         "VirusTotal_|_IP_scan_report": [
136 |                                             "Succeeded"
137 |                                         ]
138 |                                     },
139 |                                     "type": "ApiConnection",
140 |                                     "inputs": {
141 |                                         "body": {
142 |                                             "incidentArmId": "@triggerBody()?['object']?['id']",
143 |                                             "message": "<img src=\"https://vt-gtm-wp-media.storage.googleapis.com/logo.png\" alt=\"Virustotal logo\" width=\"200\"/><h3>IP address: @{body('VirusTotal_|_IP_scan_report')?['data']?['id']}</h2><hr/><h3>Detection</h3><table><tr><th>Harmless</th><th>Malicious</th><th>Suspicious</th><th>Undetected</th></tr><tr><td style='text-align: center'>@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['last_analysis_stats']?['harmless']}</td><td style='text-align: center'>@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['last_analysis_stats']?['malicious']}</td><td style='text-align: center'>@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['last_analysis_stats']?['suspicious']}</td><td style='text-align: center'>@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['last_analysis_stats']?['undetected']}</td></tr></table><ul><li>&#39;harmless&#39; : site is not malicious</li><li>&#39;undetected&#39; : scanner has no opinion about this site</li><li>&#39;suspicious&#39; : scanner thinks the site is suspicious</li><li>&#39;malicious&#39; : scanner thinks the site is malicious</li></ul><h3>Community Score</h3><table><tr><th>Malicious</th><th>Harmless</th></tr><tr><td style='text-align: center'>@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['total_votes']?['malicious']}</td><td style='text-align: center'>@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['total_votes']?['harmless']}</td></tr></table><h3>Details</h3><table><tr><th>Network</th><td>@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['network']}</td></tr><tr><th>ASN Number</th><td>@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['asn']}</td></tr><tr><th>ASN Label</th><td>@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['as_owner']}</td></tr><tr><th>Regional Internet Registry</th><td>@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['regional_internet_registry']}</td></tr><tr><th>Country</th><td>@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['country']}</td></tr><tr><th>Continent</th><td>@{body('VirusTotal_|_IP_scan_report')?['data']?['attributes']?['continent']}</td></tr></table>[Full report](https://www.virustotal.com/gui/ip-address/@{body('VirusTotal_|_IP_scan_report')?['data']?['id']})"
144 |                                         },
145 |                                         "host": {
146 |                                             "connection": {
147 |                                                 "name": "@parameters('$connections')['azuresentinel']['connectionId']"
148 |                                             }
149 |                                         },
150 |                                         "method": "post",
151 |                                         "path": "/Incidents/Comment"
152 |                                     }
153 |                                 },
154 |                                 "VirusTotal_|_IP_scan_report": {
155 |                                     "runAfter": {},
156 |                                     "type": "ApiConnection",
157 |                                     "inputs": {
158 |                                         "host": {
159 |                                             "connection": {
160 |                                                 "name": "@parameters('$connections')['virustotal']['connectionId']"
161 |                                             }
162 |                                         },
163 |                                         "method": "get",
164 |                                         "path": "/api/v3/ip_addresses/@{encodeURIComponent(items('Loop_through_all_IPs')?['Address'])}"
165 |                                     }
166 |                                 }
167 |                             },
168 |                             "runAfter": {
169 |                                 "Entities_-_Get_FileHashes": [
170 |                                     "Succeeded"
171 |                                 ]
172 |                             },
173 |                             "type": "Foreach"
174 |                         },
175 |                         "Loop_through_all_file_hashes": {
176 |                             "foreach": "@body('Entities_-_Get_FileHashes')?['Filehashes']",
177 |                             "actions": {
178 |                                 "If_not_reported_before": {
179 |                                     "actions": {
180 |                                         "Add_comment_to_incident_(V3)_2": {
181 |                                             "runAfter": {},
182 |                                             "type": "ApiConnection",
183 |                                             "inputs": {
184 |                                                 "body": {
185 |                                                     "incidentArmId": "@triggerBody()?['object']?['id']",
186 |                                                     "message": "<img src=\"https://vt-gtm-wp-media.storage.googleapis.com/logo.png\" alt=\"Virustotal logo\" width=\"200\"/><h3>File: @{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['meaningful_name']} - @{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['id']}</h2><hr/><h3>Detection</h3>@{if(contains(body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes'],'sigma_analysis_stats'),concat('<h4>Crowdsourced Sigma Rules</h4><table><tr><th>Critical</th><th>High</th><th>Medium</th><th>Low</th></tr><tr><td style=\"text-align:center\">',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['sigma_analysis_stats']?['critical'],'</td><td style=\"text-align:center\">',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['sigma_analysis_stats']?['high'],'</td><td style=\"text-align:center\">',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['sigma_analysis_stats']?['medium'],'</td><td style=\"text-align:center\">',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['sigma_analysis_stats']?['low'],'</td></tr></table>'),null)}@{if(contains(body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes'],'crowdsourced_ids_stats'),concat('<h4>Crowdsourced IDS Rules</h4><table><tr><th>High</th><th>Medium</th><th>Low</th><th>Info</th></tr><tr><td style=\"text-align:center\">',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['crowdsourced_ids_stats']?['high'],'</td><td style=\"text-align:center\">',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['crowdsourced_ids_stats']?['medium'],'</td><td style=\"text-align:center\">',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['crowdsourced_ids_stats']?['low'],'</td><td style=\"text-align:center\">',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['crowdsourced_ids_stats']?['info'],'</td></tr></table>'),null)}<h4>Analyses</h4><table><tr><th>Harmless</th><th>Malicious</th><th>Suspicious</th><th>Undetected</th></tr><tr><td style='text-align:center'>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['last_analysis_stats']?['harmless']}</td><td style='text-align:center'>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['last_analysis_stats']?['malicious']}</td><td style='text-align:center'>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['last_analysis_stats']?['suspicious']}</td><td style='text-align:center'>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['last_analysis_stats']?['undetected']}</td></tr></table><h3>Community Score</h3><table><tr><th>Malicious</th><th>Harmless</th></tr><tr><td style='text-align:center'>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['total_votes']?['malicious']}</td><td style='text-align:center'>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['total_votes']?['harmless']}</td></tr></table><h3>Details</h3><h4>Basic Properties</h4><table><tr><th>MD5</th><td>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['md5']}</td></tr><tr><th>SHA-1</th><td>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['sha1']}</td></tr><tr><th>SHA-256</th><td>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['sha256']}</td></tr><tr><th>File type</th><td>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['type_description']}</td></tr><tr><th>Magic</th><td>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['magic']}</td></tr><tr><th>File size</th><td>@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['size']} bytes</td></tr></table><h4>History</h4><table>@{if(contains(body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes'],'creation_date'),concat('<tr><th>Creation Time</th><td>',addToTime('1970-01-01T00:00:00Z',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['creation_date'],'Second','u'),'</td></tr>'),null)}<tr><th>First Submission</th><td>@{addToTime('1970-01-01T00:00:00Z',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['first_submission_date'],'Second','u')}</td></tr><tr><th>Last Submission</th><td>@{addToTime('1970-01-01T00:00:00Z',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['last_submission_date'],'Second','u')}</td></tr><tr><th>Last Analysis</th><td>@{addToTime('1970-01-01T00:00:00Z',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['last_analysis_date'],'Second','u')}</td></tr>@{if(contains(body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes'],'last_modification_date'),concat('<tr><th>Latest Contents Modification</th><td>',addToTime('1970-01-01T00:00:00Z',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['last_modification_date'],'Second','u'),'</td></tr>'),null)}</table>@{if(contains(body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes'],'trusted_verdict'),concat('<h4>Known source</h4><table><tr><th>Organization</th><td>',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['trusted_verdict']?['organization'],'</td></tr><tr><th>File name</th><td>',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['trusted_verdict']?['filename'],'</td></tr></table>'),null)}@{if(contains(body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes'],'signature_info'),concat('<h4>Signature Info</h4><table><tr><th>Signature verifiation</th><td>',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['signature_info']?['verified'],'</td></tr><tr><th>Copyright</th><td>',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['signature_info']?['copyright'],'</td></tr><tr><th>Product</th><td>',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['signature_info']?['product'],'</td></tr><tr><th>Description</th><td>',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['signature_info']?['description'],'</td></tr><tr><th>Original Name</th><td>',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['signature_info']?['original name'],'</td></tr><tr><th>Internal Name</th><td>',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['signature_info']?['internal name'],'</td></tr><tr><th>File Version</th><td>',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['signature_info']?['file version'],'</td></tr><tr><th>Date signed</th><td>',body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['attributes']?['signature_info']?['signing date'],'</td></tr></table>'),null)}[Full report](https://www.virustotal.com/gui/file/@{body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['id']})"
187 |                                                 },
188 |                                                 "host": {
189 |                                                     "connection": {
190 |                                                         "name": "@parameters('$connections')['azuresentinel']['connectionId']"
191 |                                                     }
192 |                                                 },
193 |                                                 "method": "post",
194 |                                                 "path": "/Incidents/Comment"
195 |                                             }
196 |                                         },
197 |                                         "Append_to_array_variable": {
198 |                                             "runAfter": {
199 |                                                 "Add_comment_to_incident_(V3)_2": [
200 |                                                     "Succeeded"
201 |                                                 ]
202 |                                             },
203 |                                             "type": "AppendToArrayVariable",
204 |                                             "inputs": {
205 |                                                 "name": "reported_ids",
206 |                                                 "value": "@body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['id']"
207 |                                             }
208 |                                         }
209 |                                     },
210 |                                     "runAfter": {
211 |                                         "VirusTotal_|_Retrieve_information_about_a_file": [
212 |                                             "Succeeded"
213 |                                         ]
214 |                                     },
215 |                                     "expression": {
216 |                                         "and": [
217 |                                             {
218 |                                                 "not": {
219 |                                                     "contains": [
220 |                                                         "@variables('reported_ids')",
221 |                                                         "@body('VirusTotal_|_Retrieve_information_about_a_file')?['data']?['id']"
222 |                                                     ]
223 |                                                 }
224 |                                             }
225 |                                         ]
226 |                                     },
227 |                                     "type": "If"
228 |                                 },
229 |                                 "VirusTotal_|_Retrieve_information_about_a_file": {
230 |                                     "runAfter": {},
231 |                                     "type": "ApiConnection",
232 |                                     "inputs": {
233 |                                         "host": {
234 |                                             "connection": {
235 |                                                 "name": "@parameters('$connections')['virustotal']['connectionId']"
236 |                                             }
237 |                                         },
238 |                                         "method": "get",
239 |                                         "path": "/api/v3/files/@{encodeURIComponent(items('Loop_through_all_file_hashes')?['Value'])}"
240 |                                     }
241 |                                 }
242 |                             },
243 |                             "runAfter": {
244 |                                 "Initialize_array_|_reported_ids": [
245 |                                     "Succeeded"
246 |                                 ]
247 |                             },
248 |                             "type": "Foreach",
249 |                             "runtimeConfiguration": {
250 |                                 "concurrency": {
251 |                                     "repetitions": 1
252 |                                 }
253 |                             }
254 |                         }
255 |                     },
256 |                     "outputs": {}
257 |                 },
258 |                 "parameters": {
259 |                     "$connections": {
260 |                         "value": {
261 |                             "azuresentinel": {
262 |                                 "connectionId": "[resourceId('Microsoft.Web/connections', 'api-connection-azuresentinel')]",
263 |                                 "connectionName": "azuresentinel",
264 |                                 "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
265 |                             },
266 |                             "virustotal": {
267 |                                 "connectionId": "[resourceId('Microsoft.Web/connections', 'api-connection-virustotal')]",
268 |                                 "connectionName": "virustotal",
269 |                                 "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/virustotal')]"
270 |                             }
271 |                         }
272 |                     }
273 |                 }
274 |             }
275 |         }
276 |     ]
277 | }


--------------------------------------------------------------------------------