BenjiSec/MVPSummit2024

Create Attack Distruption scenario using Logic Apps

author: Benji Kovacevic & Christos Ventouris (cventour)

This is sample playbook demonstrating how to create Attack Distruption scenario using Logic Apps.

Prerequisites

1. Create App Registration in Entra ID portal and save Tenant ID, Application ID
2. Create and save Secret for App Registration (Note: We always suggest to use Azure Key Vault to save a secret to.)
3. Assign AdvancedHunting.Read.All permission to created App Registration (APIs my organization uses -> Microsoft Threat Protection)
4. Save Object ID of SOC group from Entra ID
5. Create Pan OS API key

Quick Deployment

Deploy a playbook

Post-deployment

1. Authorize Microsft Defender for Endpoint, Entra ID, and Microsoft Outlook connections

Note

You can update Hunting query used in Parameters section of Logic App. Please note that you will need to update action Parse JSON with new schema based on Hunting query result, as well as values used from Parse JSON action in the rest of the Logic App.