Initial version of baseVISION TI Solution #11855
Conversation
|
@microsoft-github-policy-service agree company="baseVISION AG" |
|
Please add workbook metadata to this file |
| "version": "0.30.23.60470", | ||
| "templateHash": "14242225795612779748" | ||
| }, | ||
| "title": "baseVISION Threat Intel - Telemetry", |
There was a problem hiding this comment.
Please add postdeployment steps in metadata. You can refer to any other playbook for the same
| "Name": "baseVISION Threat Intelligence", | ||
| "Author": "baseVISION - support@basevision.ch", | ||
| "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/baseVISION%20Threat%20Intel/Workbooks/Images/baseVISION.svg\" width=\"75px\" height=\"75px\">", | ||
| "Description": "The baseVISION Threat Intel Feeds offering provides tactical threat intelligence to detect and protect against known threats within an organization's environment before they can cause harm. The service leverages multiple sources integrated into its platform, curated and maintained by specialists to ensure quality, including Indicators of Compromise (IOCs), confidence levels, and expiration. The sources include data gathered from customers during incident analysis and response, as well as paid feeds from highly rated threat intelligence providers.\n\n**Important:** _This Sentinel Solution provides additional components to our Threat Intel Feeds which can be bought via Microsoft Azure Marketplace._\r\n\n", |
There was a problem hiding this comment.
instead of just sentinel use Microsoft Sentinel
|
|
Hello @ThomasKur, Can you provide me write access to your branch. |
Provided the access @v-prasadboke |
| "laName": "[parameters('PlaybookName')]", | ||
| "azureSentinelConnectionName": "[format('{0}-azmon-connection', parameters('PlaybookName'))]", | ||
| "uamiName": "[format('{0}-uami', parameters('PlaybookName'))]", | ||
| "roleDefinitionSentinelReaderId": "8d289c81-5878-46d4-8554-54e1e3d8b5cb" |
There was a problem hiding this comment.
please change name of "roleDefinitionSentinelReaderId"
remove id from the variable name. it is causing an arm ttk failure
Required items, please complete
Change(s):
Reason for Change(s):
Version Updated:
Testing Completed:
Checked that the validations are passing and have addressed any issues that are present: