riposte-marketplace/integrations/azure-security/manifest.yaml

id: azure_security
name: Microsoft Azure
version: 1.1.0
description: "Microsoft Azure (Resource Manager: Defender for Cloud + Network) — cloud containment: list and read Defender for Cloud security alerts and update their state, read the secure score, list/read network security groups (NSGs), and add or delete NSG security rules (deny inbound to isolate). Azure AD OAuth2 client-credentials authentication; stdlib-only, no extra Python dependencies."
changelog: "1.1.0 — Declare the risk tier on the 3 commands that carried none: 1 safe_write, 2 destructive. An unset risk is read as destructive by the agent approval gate, so the 1 that only annotate sat behind the same prompt as the ones that change the estate. | 1.0.0 — Initial release: list/get security alerts, update alert state, secure score, list/get NSGs, create/delete NSG security rules."
category: cloud

# Per-instance configuration. Uses application (client-credentials) OAuth2 with
# a service principal that has Reader + Security Admin + Network Contributor on
# the subscription.
config_schema:
  properties:
    tenant_id:
      type: string
      description: "Azure AD tenant ID"
    client_id:
      type: string
      description: "Service principal (client) ID"
    client_secret:
      type: string
      description: "Service principal client secret"
      x-soar-sensitive: true
    subscription_id:
      type: string
      description: "Azure subscription ID"
  required:
    - tenant_id
    - client_id
    - client_secret
    - subscription_id

commands:
  - id: list_alerts
    name: azure-list-alerts
    description: "List Microsoft Defender for Cloud security alerts in the subscription."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
  - id: get_alert
    name: azure-get-alert
    description: "Get a single security alert by its full ARM resource ID."
    risk: read
    inputs_schema:
      properties:
        alert_id: { type: string, description: "Full ARM resource ID of the alert (from azure-list-alerts)" }
      required: [alert_id]
    outputs_schema: { properties: {} }
  - id: update_alert_state
    name: azure-update-alert-state
    description: "Change a security alert's state (dismiss, resolve, activate, or inProgress)."
    risk: safe_write
    inputs_schema:
      properties:
        alert_id: { type: string, description: "Full ARM resource ID of the alert" }
        state: { type: string, description: "dismiss | resolve | activate | inProgress" }
      required: [alert_id, state]
    outputs_schema: { properties: {} }
  - id: get_secure_score
    name: azure-get-secure-score
    description: "Get the subscription's Defender for Cloud secure score."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
  - id: list_nsgs
    name: azure-list-nsgs
    description: "List network security groups in the subscription."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
  - id: get_nsg
    name: azure-get-nsg
    description: "Get a single network security group."
    risk: read
    inputs_schema:
      properties:
        resource_group: { type: string, description: "Resource group name" }
        nsg_name: { type: string, description: "NSG name" }
      required: [resource_group, nsg_name]
    outputs_schema: { properties: {} }
  - id: create_nsg_rule
    name: azure-create-nsg-rule
    description: "Create or update an NSG security rule (e.g. a Deny inbound rule to isolate a resource)."
    risk: destructive
    inputs_schema:
      properties:
        resource_group: { type: string, description: "Resource group name" }
        nsg_name: { type: string, description: "NSG name" }
        rule_name: { type: string, description: "Security rule name" }
        priority: { type: number, description: "Rule priority (100-4096)" }
        direction: { type: string, description: "Inbound or Outbound (default Inbound)" }
        access: { type: string, description: "Allow or Deny (default Deny)" }
        protocol: { type: string, description: "Tcp, Udp, or * (default *)" }
        source: { type: string, description: "Source address prefix (CIDR or *, default *)" }
        destination: { type: string, description: "Destination address prefix (default *)" }
        destination_port: { type: string, description: "Destination port range (default *)" }
      required: [resource_group, nsg_name, rule_name, priority]
    outputs_schema: { properties: {} }
  - id: delete_nsg_rule
    name: azure-delete-nsg-rule
    description: "Delete an NSG security rule."
    risk: destructive
    inputs_schema:
      properties:
        resource_group: { type: string, description: "Resource group name" }
        nsg_name: { type: string, description: "NSG name" }
        rule_name: { type: string, description: "Security rule name" }
      required: [resource_group, nsg_name, rule_name]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: azure-test-connection
    description: "Verify connectivity and the service-principal credentials (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }