feat(azure-security): new Microsoft Azure cloud-containment integration

Azure Resource Manager (Defender for Cloud + Network), 9 commands: list/get security alerts, update alert state, secure score, list/get NSGs, create/delete NSG security rules (deny inbound to isolate). OAuth2 client-credentials, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-11 23:54:01 +02:00
parent 62a44aea28
commit 31d0a5938a
10 changed files with 801 additions and 0 deletions
@@ -0,0 +1,120 @@
+id: azure_security
+name: Microsoft Azure
+version: 1.0.0
+description: "Microsoft Azure (Resource Manager: Defender for Cloud + Network) — cloud containment: list and read Defender for Cloud security alerts and update their state, read the secure score, list/read network security groups (NSGs), and add or delete NSG security rules (deny inbound to isolate). Azure AD OAuth2 client-credentials authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: list/get security alerts, update alert state, secure score, list/get NSGs, create/delete NSG security rules."
+category: cloud
+
+# Per-instance configuration. Uses application (client-credentials) OAuth2 with
+# a service principal that has Reader + Security Admin + Network Contributor on
+# the subscription.
+config_schema:
+  properties:
+    tenant_id:
+      type: string
+      description: "Azure AD tenant ID"
+    client_id:
+      type: string
+      description: "Service principal (client) ID"
+    client_secret:
+      type: string
+      description: "Service principal client secret"
+      x-soar-sensitive: true
+    subscription_id:
+      type: string
+      description: "Azure subscription ID"
+  required:
+    - tenant_id
+    - client_id
+    - client_secret
+    - subscription_id
+
+commands:
+  - id: list_alerts
+    name: azure-list-alerts
+    description: "List Microsoft Defender for Cloud security alerts in the subscription."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_alert
+    name: azure-get-alert
+    description: "Get a single security alert by its full ARM resource ID."
+    risk: read
+    inputs_schema:
+      properties:
+        alert_id: { type: string, description: "Full ARM resource ID of the alert (from azure-list-alerts)" }
+      required: [alert_id]
+    outputs_schema: { properties: {} }
+  - id: update_alert_state
+    name: azure-update-alert-state
+    description: "Change a security alert's state (dismiss, resolve, activate, or inProgress)."
+    inputs_schema:
+      properties:
+        alert_id: { type: string, description: "Full ARM resource ID of the alert" }
+        state: { type: string, description: "dismiss | resolve | activate | inProgress" }
+      required: [alert_id, state]
+    outputs_schema: { properties: {} }
+  - id: get_secure_score
+    name: azure-get-secure-score
+    description: "Get the subscription's Defender for Cloud secure score."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }
+  - id: list_nsgs
+    name: azure-list-nsgs
+    description: "List network security groups in the subscription."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_nsg
+    name: azure-get-nsg
+    description: "Get a single network security group."
+    risk: read
+    inputs_schema:
+      properties:
+        resource_group: { type: string, description: "Resource group name" }
+        nsg_name: { type: string, description: "NSG name" }
+      required: [resource_group, nsg_name]
+    outputs_schema: { properties: {} }
+  - id: create_nsg_rule
+    name: azure-create-nsg-rule
+    description: "Create or update an NSG security rule (e.g. a Deny inbound rule to isolate a resource)."
+    inputs_schema:
+      properties:
+        resource_group: { type: string, description: "Resource group name" }
+        nsg_name: { type: string, description: "NSG name" }
+        rule_name: { type: string, description: "Security rule name" }
+        priority: { type: number, description: "Rule priority (100-4096)" }
+        direction: { type: string, description: "Inbound or Outbound (default Inbound)" }
+        access: { type: string, description: "Allow or Deny (default Deny)" }
+        protocol: { type: string, description: "Tcp, Udp, or * (default *)" }
+        source: { type: string, description: "Source address prefix (CIDR or *, default *)" }
+        destination: { type: string, description: "Destination address prefix (default *)" }
+        destination_port: { type: string, description: "Destination port range (default *)" }
+      required: [resource_group, nsg_name, rule_name, priority]
+    outputs_schema: { properties: {} }
+  - id: delete_nsg_rule
+    name: azure-delete-nsg-rule
+    description: "Delete an NSG security rule."
+    inputs_schema:
+      properties:
+        resource_group: { type: string, description: "Resource group name" }
+        nsg_name: { type: string, description: "NSG name" }
+        rule_name: { type: string, description: "Security rule name" }
+      required: [resource_group, nsg_name, rule_name]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: azure-test-connection
+    description: "Verify connectivity and the service-principal credentials (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }