Use DCR-based ingestion in Virus Total playbooks - #14848
Open
v-sabiraj wants to merge 10 commits into
Open
Conversation
Reworks the VirusTotal Domain Report incident playbook to ingest logs via Azure Monitor Logs Ingestion API using managed identity instead of the Azure Log Analytics Data Collector connector. Adds workspace/table, Data Collection Endpoint, Data Collection Rule, and scoped role assignment resources, wires their runtime parameters into the workflow, and updates report/comment text and metadata to match VTDomainReport_CL usage and new deployment prerequisites.
Introduce new alert-triggered and incident-triggered VirusTotal Domain Report playbook templates that use Logs Ingestion via Data Collection Endpoints and Rules, create the custom Log Analytics table, and grant the workflow identity the required DCR role. The existing incident-trigger template is updated to use the Azure Log Analytics Data Collector connection instead of DCR-based ingestion, along with related metadata and query text adjustments.
Update the VirusTotal domain report ARM templates to clearly identify the Log Ingestion API variants. This adjusts the playbook metadata titles and default playbook names for both alert-triggered and incident-triggered deployments so they are easier to distinguish from the non-Log-Ingestion versions.
Adds alert-triggered and incident-triggered Logic App templates that enrich file hashes with VirusTotal data and ingest results into Log Analytics through the Azure Monitor Logs Ingestion API.
Update VirusTotal playbook deployment instructions to assign the Log Analytics Reader role before configuring Sentinel responder permissions and automation rules.
Add alert- and incident-triggered Logic App deployment templates that enrich IP entities with VirusTotal reports and ingest results into Log Analytics through a Data Collection Endpoint and Rule.
Add alert-triggered and incident-triggered Logic App deployment templates that enrich URL entities with VirusTotal results and ingest reports into Log Analytics through the Azure Monitor Logs Ingestion API.
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds DCR-based (Azure Monitor Logs Ingestion API) ingestion to VirusTotal enrichment playbooks, replacing reliance on the Log Analytics Data Collector connector and wiring DCE/DCR runtime parameters into each workflow.
Changes:
- Adds ARM templates that provision custom Log Analytics tables plus Data Collection Endpoints/Rules for VirusTotal URL/IP/File/Domain enrichment outputs.
- Updates Logic App workflows to ingest records via HTTP + managed identity to the Logs Ingestion API.
- Adds scoped role assignment on the DCR for the playbook’s system-assigned identity.
Reviewed changes
Copilot reviewed 8 out of 9 changed files in this pull request and generated 11 comments.
Show a summary per file
| File | Description |
|---|---|
| Solutions/VirusTotal/Playbooks/Get-VirusTotalURLReport/incident-trigger-logingestionapi/azuredeploy.json | New incident-trigger URL enrichment template with table+DCE+DCR and MSI-based ingestion. |
| Solutions/VirusTotal/Playbooks/Get-VirusTotalURLReport/alert-trigger-logingestionapi/azuredeploy.json | New alert-trigger URL enrichment template with table+DCE+DCR and MSI-based ingestion. |
| Solutions/VirusTotal/Playbooks/Get-VirusTotalIPReport/incident-trigger-logingestionapi/azuredeploy.json | New incident-trigger IP enrichment template with table+DCE+DCR and MSI-based ingestion. |
| Solutions/VirusTotal/Playbooks/Get-VirusTotalIPReport/alert-trigger-logingestionapi/azuredeploy.json | New alert-trigger IP enrichment template with table+DCE+DCR and MSI-based ingestion. |
| Solutions/VirusTotal/Playbooks/Get-VirusTotalFileInfo/incident-trigger-logingestionapi/azuredeploy.json | New incident-trigger file-hash enrichment template with table+DCE+DCR and MSI-based ingestion. |
| Solutions/VirusTotal/Playbooks/Get-VirusTotalFileInfo/alert-trigger-logingestionapi/azuredeploy.json | New alert-trigger file-hash enrichment template with table+DCE+DCR and MSI-based ingestion. |
| Solutions/VirusTotal/Playbooks/Get-VirusTotalDomainReport/incident-trigger-logingestionapi/azuredeploy.json | New incident-trigger domain-report template with table+DCE+DCR and MSI-based ingestion. |
| Solutions/VirusTotal/Playbooks/Get-VirusTotalDomainReport/alert-trigger-logingestionapi/azuredeploy.json | New alert-trigger domain-report template with table+DCE+DCR and MSI-based ingestion. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| "location": "[resourceGroup().location]", | ||
| "tags": { | ||
| "LogicAppsCategory": "security", | ||
| "hidden-SentinelTemplateName": "Get-VirusTotalDomainReport", |
Comment on lines
+45
to
+52
| "metadata": { | ||
| "description": "Full resource ID of the Log Analytics workspace where VirusTotal URL report records will be ingested." | ||
| } | ||
| }, | ||
| "WorkspaceLocation": { | ||
| "type": "string", | ||
| "metadata": { | ||
| "description": "Azure region of the Log Analytics workspace. Used for the Data Collection Endpoint and Data Collection Rule." |
| { | ||
| "type": "Microsoft.OperationalInsights/workspaces/tables", | ||
| "apiVersion": "2022-10-01", | ||
| "name": "[concat(parameters('WorkspaceName'), '/', variables('tableName'))]", |
Comment on lines
+146
to
+147
| "workspaceResourceId": "[parameters('WorkspaceResourceId')]", | ||
| "name": "LogAnalyticsDestination" |
| "4. After deployment, attach this playbook to an **automation rule** and map FileHash entity so it runs when alert is triggered.", | ||
| "[click here for detail instructions](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VirusTotal/Playbooks/Get-VirusTotalFileInfo/readme.md)" | ||
| ], | ||
| "lastUpdateTime": "2023-02-03T00:00:00.000Z", |
| "2. Assign Microsoft Sentinel Responder Role to playbook.", | ||
| "3. Assign Log Analytics Reader Role to playbook on Log Analytics Workspace.", | ||
| "4. After deployment, attach this playbook to an **automation rule** and map URL entity so it runs when the incident is created.", | ||
| "[click here for detail instructions](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VirusTotal/Playbooks/Get-VirusTotalIPReport/readme.md)" |
| "inputs": { | ||
| "body": { | ||
| "incidentArmId": "@triggerBody()?['object']?['id']", | ||
| "message": "<p>Virus Total URL Report found for @{items('For_each')?['Url']}<br>\nSuspicious: @{outputs('Compose_URL_Report_Record')?['Suspicious']}<br>\nMalicious: @{outputs('Compose_URL_Report_Record')?['Malicious']}<br>\nQuery: VirusTotalURLReport_CL | where VirusTotalId == \"@{outputs('Compose_URL_Report_Record')?['VirusTotalId']}\"</p>" |
| "inputs": { | ||
| "body": { | ||
| "incidentArmId": "@triggerBody()?['object']?['id']", | ||
| "message": "<p>Virus Total URL Report found for @{items('For_each')?['Url']}<br>\nSuspicious: @{outputs('Compose_URL_Report_Record')?['Suspicious']}<br>\nMalicious: @{outputs('Compose_URL_Report_Record')?['Malicious']}<br>\nQuery: VirusTotalURLReport_CL | where VirusTotalId == \"@{outputs('Compose_URL_Report_Record')?['VirusTotalId']}\"</p>" |
Refresh lastUpdateTime timestamps for VirusTotal Logs Ingestion API playbooks (Domain, File, IP, URL) and expand their readme.md files with dedicated sections for Logs Ingestion API vs connector-based deployment variants, including prerequisites, deployment buttons, and required parameters (workspace name/resource ID/location, DCE/DCR names). Also clarifies post-deployment connection authorization and Log Analytics Reader role assignment steps.
Update deployment instructions in all VirusTotal URL report playbooks to reference the correct URL report README instead of the IP report documentation.
v-sabiraj
marked this pull request as ready for review
August 26, 2026 05:43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reworks the VirusTotal Domain Report incident playbook to ingest logs via Azure Monitor Logs Ingestion API using managed identity instead of the Azure Log Analytics Data Collector connector. Adds workspace/table, Data Collection Endpoint, Data Collection Rule, and scoped role assignment resources, wires their runtime parameters into the workflow, and updates report/comment text and metadata to match VTDomainReport_CL usage and new deployment prerequisites.
Required items, please complete
Change(s):
Reason for Change(s):
Version Updated:
Testing Completed:
Checked that the validations are passing and have addressed any issues that are present:
Guidance <- remove section before submitting
Before submitting this PR please ensure that you have read the following sections and filled out the changes, reason for change and testing complete sections:
Thank you for your contribution to the Microsoft Sentinel Github repo.
Change(s):
Reason for Change(s):
Version updated:
Testing Completed:
Note: If updating a detection, you must update the version field.
Checked that the validations are passing and have addressed any issues that are present:
Note: Let us know if you have tried fixing the validation error and need help.