![](\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\"width=\"75px\"height=\"75px\")
",
+ "Description": "The TacitRed Defender Threat Intelligence solution integrates TacitRed's threat intelligence feed with Microsoft Sentinel. It automatically retrieves compromised credentials and other threat indicators from TacitRed and ingests them into Microsoft Sentinel using the Upload API for enhanced threat detection.",
+ "Data Connectors": [
+ "Package/mainTemplate.json"
+ ],
+ "Playbooks": [
+ "Playbooks/TacitRedToDefenderTI_Playbook.json"
+ ],
+ "Metadata": "SolutionMetadata.json",
+ "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\TacitRed-Defender-ThreatIntelligence",
+ "Version": "1.0.0",
+ "TemplateSpec": true,
+ "Is1Pconnector": false
+}
\ No newline at end of file
diff --git a/Solutions/TacitRed-Defender-ThreatIntelligence/Package/1.0.0.zip b/Solutions/TacitRed-Defender-ThreatIntelligence/Package/1.0.0.zip
new file mode 100644
index 00000000000..65caab8c306
Binary files /dev/null and b/Solutions/TacitRed-Defender-ThreatIntelligence/Package/1.0.0.zip differ
diff --git a/Solutions/TacitRed-Defender-ThreatIntelligence/Package/createUiDefinition.json b/Solutions/TacitRed-Defender-ThreatIntelligence/Package/createUiDefinition.json
new file mode 100644
index 00000000000..9668cb57769
--- /dev/null
+++ b/Solutions/TacitRed-Defender-ThreatIntelligence/Package/createUiDefinition.json
@@ -0,0 +1,100 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#",
+ "handler": "Microsoft.Azure.CreateUIDef",
+ "version": "0.1.2-preview",
+ "parameters": {
+ "config": {
+ "isWizard": false,
+ "basics": {
+ "description": "**TacitRed Defender Threat Intelligence** automates the synchronization of threat intelligence from TacitRed to Microsoft Defender.\n\n**Playbooks:** 1\n\n[Learn more about TacitRed >](https://www.tacitred.com/)",
+ "subscription": {
+ "constraints": {
+ "validations": [
+ {
+ "permission": "Microsoft.OperationalInsights/workspaces/read",
+ "message": "Please ensure you have read permissions for the workspace"
+ }
+ ]
+ },
+ "resourceProviders": [
+ "Microsoft.OperationalInsights/workspaces",
+ "Microsoft.Logic"
+ ]
+ },
+ "location": {
+ "label": "Location",
+ "toolTip": "Location for all resources",
+ "resourceTypes": [
+ "Microsoft.OperationalInsights/workspaces"
+ ]
+ },
+ "resourceGroup": {
+ "allowExisting": true
+ }
+ }
+ },
+ "basics": [
+ {
+ "name": "getLAWorkspace",
+ "type": "Microsoft.Solutions.ArmApiControl",
+ "toolTip": "This fetches all workspaces in the subscription",
+ "condition": "[greater(length(resourceGroup().name),0)]",
+ "request": {
+ "method": "GET",
+ "path": "[concat(subscription().id,'/providers/Microsoft.OperationalInsights/workspaces?api-version=2020-08-01')]"
+ }
+ },
+ {
+ "name": "workspace-guidance",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "Please select the Microsoft Sentinel Workspace where you want to install the solution. This must be in the same Resource Group selected above."
+ }
+ },
+ {
+ "name": "workspace",
+ "type": "Microsoft.Common.DropDown",
+ "label": "Sentinel Workspace",
+ "placeholder": "Select your Sentinel Workspace",
+ "toolTip": "Select the Microsoft Sentinel workspace where you want to deploy the solution. It must be in the current Resource Group.",
+ "constraints": {
+ "allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]",
+ "required": true
+ },
+ "visible": true
+ }
+ ],
+ "steps": [
+ {
+ "name": "configuration",
+ "label": "Configuration",
+ "bladeTitle": "Configuration",
+ "elements": [
+ {
+ "name": "config-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "Please provide the configuration details for the Logic App."
+ }
+ },
+ {
+ "name": "TacitRed_ApiKey",
+ "type": "Microsoft.Common.PasswordBox",
+ "label": "TacitRed API Key",
+ "toolTip": "The API Key for TacitRed authentication.",
+ "constraints": {
+ "required": true,
+ "regex": "^[A-Za-z0-9]+$",
+ "validationMessage": "Please enter a valid API Key (alphanumeric)."
+ }
+ }
+ ]
+ }
+ ],
+ "outputs": {
+ "location": "[location()]",
+ "workspace": "[basics('workspace')]",
+ "TacitRed_ApiKey": "[steps('configuration').TacitRed_ApiKey]"
+ }
+ }
+}
\ No newline at end of file
diff --git a/Solutions/TacitRed-Defender-ThreatIntelligence/Package/functionCode.zip b/Solutions/TacitRed-Defender-ThreatIntelligence/Package/functionCode.zip
new file mode 100644
index 00000000000..65caab8c306
Binary files /dev/null and b/Solutions/TacitRed-Defender-ThreatIntelligence/Package/functionCode.zip differ
diff --git a/Solutions/TacitRed-Defender-ThreatIntelligence/Package/mainTemplate.json b/Solutions/TacitRed-Defender-ThreatIntelligence/Package/mainTemplate.json
new file mode 100644
index 00000000000..5f6a5e6015b
--- /dev/null
+++ b/Solutions/TacitRed-Defender-ThreatIntelligence/Package/mainTemplate.json
@@ -0,0 +1,300 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "1.0.0.0",
+ "metadata": {
+ "author": "TacitRed",
+ "comments": "TacitRed Defender Threat Intelligence Solution"
+ },
+ "parameters": {
+ "location": {
+ "type": "string",
+ "defaultValue": "[resourceGroup().location]",
+ "metadata": {
+ "description": "Location for all resources"
+ }
+ },
+ "workspace": {
+ "type": "string",
+ "metadata": {
+ "description": "Workspace name for Microsoft Sentinel"
+ }
+ },
+ "TacitRed_ApiKey": {
+ "type": "securestring",
+ "metadata": {
+ "description": "TacitRed API Key"
+ }
+ },
+ "_artifactsLocation": {
+ "type": "string",
+ "metadata": {
+ "description": "The base URI where artifacts required by this template are located"
+ },
+ "defaultValue": "[if(contains(deployment().properties, 'templateLink'), deployment().properties.templateLink.uri, deployment().properties.template.contentVersion)]"
+ },
+ "_artifactsLocationSasToken": {
+ "type": "securestring",
+ "metadata": {
+ "description": "The sasToken required to access _artifactsLocation"
+ },
+ "defaultValue": ""
+ }
+ },
+ "variables": {
+ "logicAppName": "logic-tacitred-defender",
+ "functionAppName": "[concat('func-tacitred-', uniqueString(resourceGroup().id))]",
+ "hostingPlanName": "[concat('plan-tacitred-', uniqueString(resourceGroup().id))]",
+ "storageAccountName": "[concat('sttac', uniqueString(resourceGroup().id))]",
+ "appInsightsName": "[concat('appi-tacitred-', uniqueString(resourceGroup().id))]",
+ "sentinelContributorRole": "ab8e14d6-4a74-4a29-9ba8-549422addade",
+ "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace'))]",
+ "_solutionName": "TacitRed Defender Threat Intelligence",
+ "_solutionVersion": "1.0.0",
+ "_solutionId": "tacitred-defender-threat-intelligence",
+ "_solutioncontentProductId": "[concat('TacitRed-Defender-TI-Solution-', variables('_solutionId'), '-', variables('_solutionVersion'))]"
+ },
+ "resources": [
+ {
+ "type": "Microsoft.Storage/storageAccounts",
+ "apiVersion": "2024-01-01",
+ "name": "[variables('storageAccountName')]",
+ "location": "[parameters('location')]",
+ "sku": {
+ "name": "Standard_LRS"
+ },
+ "kind": "StorageV2"
+ },
+ {
+ "type": "Microsoft.Insights/components",
+ "apiVersion": "2020-02-02",
+ "name": "[variables('appInsightsName')]",
+ "location": "[parameters('location')]",
+ "kind": "web",
+ "properties": {
+ "Application_Type": "web"
+ }
+ },
+ {
+ "type": "Microsoft.Web/serverfarms",
+ "apiVersion": "2024-11-01",
+ "name": "[variables('hostingPlanName')]",
+ "location": "[parameters('location')]",
+ "sku": {
+ "name": "Y1",
+ "tier": "Dynamic"
+ },
+ "properties": {
+ "reserved": true
+ }
+ },
+ {
+ "type": "Microsoft.Web/sites",
+ "apiVersion": "2023-12-01",
+ "name": "[variables('functionAppName')]",
+ "location": "[parameters('location')]",
+ "kind": "functionapp,linux",
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "properties": {
+ "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('hostingPlanName'))]",
+ "siteConfig": {
+ "appSettings": [
+ {
+ "name": "AzureWebJobsStorage",
+ "value": "[concat('DefaultEndpointsProtocol=https;AccountName=', variables('storageAccountName'), ';AccountKey=', listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName')), '2024-01-01').keys[0].value)]"
+ },
+ {
+ "name": "WEBSITE_CONTENTAZUREFILECONNECTIONSTRING",
+ "value": "[concat('DefaultEndpointsProtocol=https;AccountName=', variables('storageAccountName'), ';AccountKey=', listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName')), '2024-01-01').keys[0].value)]"
+ },
+ {
+ "name": "WEBSITE_CONTENTSHARE",
+ "value": "[toLower(variables('functionAppName'))]"
+ },
+ {
+ "name": "FUNCTIONS_EXTENSION_VERSION",
+ "value": "~4"
+ },
+ {
+ "name": "FUNCTIONS_WORKER_RUNTIME",
+ "value": "python"
+ },
+ {
+ "name": "APPINSIGHTS_INSTRUMENTATIONKEY",
+ "value": "[reference(resourceId('Microsoft.Insights/components', variables('appInsightsName')), '2020-02-02').InstrumentationKey]"
+ },
+ {
+ "name": "TACITRED_API_URL",
+ "value": "https://app.tacitred.com/api/v1/findings"
+ },
+ {
+ "name": "SOURCE_SYSTEM",
+ "value": "TacitRed"
+ },
+ {
+ "name": "SENTINEL_WORKSPACE_ID",
+ "value": "[variables('workspaceResourceId')]"
+ },
+ {
+ "name": "WEBSITE_RUN_FROM_PACKAGE",
+ "value": "[if(not(empty(parameters('_artifactsLocation'))), uri(parameters('_artifactsLocation'), concat('Package/functionCode.zip', parameters('_artifactsLocationSasToken'))), '1')]"
+ }
+ ],
+ "linuxFxVersion": "PYTHON|3.11"
+ }
+ },
+ "dependsOn": [
+ "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]",
+ "[resourceId('Microsoft.Web/serverfarms', variables('hostingPlanName'))]",
+ "[resourceId('Microsoft.Insights/components', variables('appInsightsName'))]"
+ ]
+ },
+ {
+ "type": "Microsoft.Authorization/roleAssignments",
+ "apiVersion": "2022-04-01",
+ "name": "[guid(resourceGroup().id, variables('functionAppName'), 'SentinelContributor')]",
+ "scope": "[concat('Microsoft.OperationalInsights/workspaces/', parameters('workspace'))]",
+ "properties": {
+ "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('sentinelContributorRole'))]",
+ "principalId": "[reference(resourceId('Microsoft.Web/sites', variables('functionAppName')), '2023-12-01', 'Full').identity.principalId]",
+ "principalType": "ServicePrincipal"
+ },
+ "dependsOn": [
+ "[resourceId('Microsoft.Web/sites', variables('functionAppName'))]"
+ ]
+ },
+ {
+ "type": "Microsoft.Logic/workflows",
+ "apiVersion": "2019-05-01",
+ "name": "[variables('logicAppName')]",
+ "location": "[parameters('location')]",
+ "identity": {
+ "type": "SystemAssigned"
+ },
+ "properties": {
+ "state": "Enabled",
+ "definition": {
+ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ "TacitRed_ApiKey": {
+ "type": "string",
+ "defaultValue": "[parameters('TacitRed_ApiKey')]"
+ }
+ },
+ "triggers": {
+ "Recurrence": {
+ "type": "Recurrence",
+ "recurrence": {
+ "frequency": "Hour",
+ "interval": 6,
+ "timeZone": "UTC"
+ }
+ }
+ },
+ "actions": {
+ "Initialize_Config": {
+ "type": "InitializeVariable",
+ "inputs": {
+ "variables": [
+ {
+ "name": "FunctionAppUrl",
+ "type": "String",
+ "value": "[concat('https://', reference(resourceId('Microsoft.Web/sites', variables('functionAppName')), '2023-12-01').defaultHostName, '/api/TacitRedToDefenderTI')]"
+ },
+ {
+ "name": "Domains",
+ "type": "Array",
+ "value": [
+ "usbank.com"
+ ]
+ }
+ ]
+ },
+ "runAfter": {}
+ },
+ "Call_Function_App": {
+ "type": "Http",
+ "inputs": {
+ "method": "POST",
+ "uri": "@variables('FunctionAppUrl')",
+ "headers": {
+ "Content-Type": "application/json"
+ },
+ "body": {
+ "domains": "@variables('Domains')",
+ "date_from": "@{formatDateTime(addMinutes(utcNow(), -600), 'yyyy-MM-ddTHH:mm:ssZ')}",
+ "date_until": "@{formatDateTime(utcNow(), 'yyyy-MM-ddTHH:mm:ssZ')}",
+ "tacitred_api_key": "@parameters('TacitRed_ApiKey')"
+ }
+ },
+ "runAfter": {
+ "Initialize_Config": [
+ "Succeeded"
+ ]
+ }
+ }
+ }
+ }
+ },
+ "dependsOn": [
+ "[resourceId('Microsoft.Web/sites', variables('functionAppName'))]"
+ ]
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[concat(parameters('workspace'), '/Microsoft.SecurityInsights/', variables('_solutionId'))]",
+ "location": "[parameters('location')]",
+ "properties": {
+ "version": "[variables('_solutionVersion')]",
+ "kind": "Solution",
+ "contentSchemaVersion": "3.0.0",
+ "displayName": "[variables('_solutionName')]",
+ "publisherDisplayName": "TacitRed",
+ "descriptionHtml": "TacitRed Defender Threat Intelligence provides automated synchronization of threat intelligence from TacitRed to Microsoft Defender.
This solution includes:
Key Features:
TacitRed Defender Threat Intelligence provides automated synchronization of threat intelligence from TacitRed to Microsoft Defender.
This solution includes:
Key Features: