Guillaume BOURGEOIS
4020e13df9
DLP alerts via Microsoft Graph Security API, 6 commands: list/get DLP alerts, update alert (status/assignee/determination), list/get incidents. Azure AD OAuth2 client-credentials auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
86 lines
3.1 KiB
YAML
86 lines
3.1 KiB
YAML
id: microsoft_purview
|
|
name: Microsoft Purview
|
|
version: 1.0.0
|
|
description: "Microsoft Purview DLP alerts (via Microsoft Graph Security API) — data-loss-prevention triage: list and read DLP security alerts, update alert status/assignment, and list/read security incidents. Azure AD OAuth2 client-credentials authentication; stdlib-only, no extra Python dependencies."
|
|
changelog: "1.0.0 — Initial release: list/get DLP alerts, update alert, list/get incidents."
|
|
category: dlp
|
|
|
|
# Per-instance configuration. Application (client-credentials) OAuth2. Needs Graph
|
|
# application permissions SecurityAlert.ReadWrite.All and SecurityIncident.Read.All.
|
|
config_schema:
|
|
properties:
|
|
tenant_id:
|
|
type: string
|
|
description: "Azure AD tenant ID"
|
|
client_id:
|
|
type: string
|
|
description: "App registration (client) ID"
|
|
client_secret:
|
|
type: string
|
|
description: "App registration client secret"
|
|
x-soar-sensitive: true
|
|
required:
|
|
- tenant_id
|
|
- client_id
|
|
- client_secret
|
|
|
|
commands:
|
|
- id: list_dlp_alerts
|
|
name: purview-list-dlp-alerts
|
|
description: "List Data Loss Prevention alerts."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
status: { type: string, description: "Filter by status (new, inProgress, resolved)" }
|
|
limit: { type: number, description: "Max alerts (default 25)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: get_alert
|
|
name: purview-get-alert
|
|
description: "Get a single security alert by ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
alert_id: { type: string, description: "Alert ID" }
|
|
required: [alert_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: update_alert
|
|
name: purview-update-alert
|
|
description: "Update an alert's status and/or assignee."
|
|
inputs_schema:
|
|
properties:
|
|
alert_id: { type: string, description: "Alert ID" }
|
|
status: { type: string, description: "new, inProgress, or resolved" }
|
|
assigned_to: { type: string, description: "Assignee (UPN)" }
|
|
determination: { type: string, description: "Optional determination (e.g. truePositive, falsePositive)" }
|
|
required: [alert_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: list_incidents
|
|
name: purview-list-incidents
|
|
description: "List security incidents."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
status: { type: string, description: "Filter by status (active, resolved, redirected)" }
|
|
limit: { type: number, description: "Max incidents (default 25)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: get_incident
|
|
name: purview-get-incident
|
|
description: "Get a single security incident by ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
incident_id: { type: string, description: "Incident ID" }
|
|
required: [incident_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: purview-test-connection
|
|
description: "Verify connectivity and the app credentials (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|