<style>p { margin: 0; }span.fr-emoticon.fr-emoticon-img { background-repeat: no-repeat !important; font-size: inherit; height: 1em; width: 1em; min-height: 20px; min-width: 20px; display: inline-block; margin: -0.1em 0.1em 0.1em; line-height: 1; vertical-align: middle; } span.fr-emoticon { font-weight: normal; font-family: "Apple Color Emoji", "Segoe UI Emoji", "NotoColorEmoji", "Segoe UI Symbol", "Android Emoji", "EmojiSymbols"; display: inline; line-height: 0; } blockquote { border-left: solid 2px #5e35b1; color: #5e35b1; margin-left:0; padding-left:5px;}blockquote blockquote{ border-color: #00bcd4; color: #00bcd4;}blockquote blockquote blockquote{ border-color: #43a047; color: #43a047;} table.grid{ border-collapse: collapse;} table.grid td, table.grid th { border: 1px solid #ddd;} .fr-fic.fr-dib{ display: block; margin: 5px auto;}.fr-fic.fr-dib.fr-fir{ text-align: right; margin: 5px 0 5px auto;}.fr-fic.fr-dib.fr-fil{ text-align: left; margin: 5px auto 5px 0;}.fr-fic.fr-dii{ float: none; margin: 5px auto;}.fr-fic.fr-dii.fr-fil{ float: left; margin: 5px auto;}.fr-fic.fr-dii.fr-fir{ float: right; margin: 5px auto;}img.fr-dib.fr-fir { margin-right: 0; text-align: right;}img.fr-dib.fr-fil { margin-left: 0; text-align: left;}img.fr-dib { margin: 5px auto; display: block; float: none;}img.fr-bordered { box-sizing: content-box; border: solid 5px #CCC;}img.fr-shadow { box-shadow: 10px 10px 5px 0px #cccccc;}img.fr-rounded { border-radius: 10px; -moz-border-radius: 10px; -webkit-border-radius: 10px; -moz-background-clip: padding; -webkit-background-clip: padding-box; background-clip: padding-box;}</style><p id="isPasted"><strong><em>This guide only covers the setup of the webhooks required. <strong data-pasted="true"><em>You will need to configure Azure Sentinel before you can use your webhooks. </em></strong>For comprehensive setup of the integration (including webhooks) checkout: <a href="https://usehalo.com/haloitsm/guides/1258/" target="_blank" rel="noopener noreferrer"><strong>Azure Sentinel Integration</strong></a>.</em></strong></p><p><br></p><p><strong>In this guide we will cover:</strong></p><p><strong>- Creating a Logic App in Microsoft Azure</strong></p><p><strong>- Sentinel Automation Rules</strong></p><p><strong>- Troubleshooting your Webhook</strong></p><p><br></p><p>This guide explains how to set up webhooks in Azure Sentinel to create tickets in your Halo instance. You will need to be able to create Logic apps and Sentinel Automations.</p><p><br></p><p><strong><span style="font-size: 14pt;">Creating a Logic App in Microsoft Azure</span></strong></p><p>Select the Multi-tenant Consumption hosting option.</p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6Ijk0YzExNmNiLTM0NDEtNDQ0ZS04NjgyLWM3YjliYTMxYjkyZiJ9.giAAgCK4-jKoyuLBtg0VRHhj2DTLvxwwrQxZm0sSFIE" width="703" style="width: 705px; height: 227.197px;" height="227" class="fr-fic fr-dii"></p><p><strong><span style="font-size: 10pt;">Fig 1. Creating a new logic app.</span></strong></p><p><br></p><p>Fill out the Project and Instance details.</p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImZmNGEzOGRkLWRjZmQtNGNiNi05NjMzLTZiMWU1MDQ5YThjNyJ9.q--Ah6y3BbU3sjYH3qCtnx5cWiGeFj0zRmja5REn68c" width="630" style="width: 632px; height: 550.779px;" height="551" class="fr-fic fr-dii"></p><p><strong><span style="font-size: 10pt;">Fig 2. Filling out details.</span></strong></p><p><br></p><p>Once your Logic app has been deployed, go to the Logic app designer section under the Development Tools tab.</p><p><br></p><p>Add a trigger and select the “Microsoft Sentinel incident” option.</p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjUwZWEzZGMyLTkwNDctNDU3Mi1iODU0LWRiYTA4YmVmYmFiZiJ9.AF4DvBIQhoMXvqr9vofeAxueMucgD8qAWC_255uzIQE" width="644" style="width: 646px; height: 314.325px;" height="314" class="fr-fic fr-dii"></p><p><br></p><p>Add a new step after the Sentinel trigger and search for “HTTP”:</p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImQxYTZkMzBiLWUwY2MtNDM1NC04YWU3LTE4ZjFkZjI4NWE1YiJ9.ctowE2FG0DeuBWbZyGOc5bQEZLsZB1p6XubRCseLnu0" width="683" style="width: 685px; height: 264.77px;" height="265" class="fr-fic fr-dii"></p><p><strong><span style="font-size: 10pt;">Fig 3. Adding a trigger.</span></strong></p><p><br></p><p>Fill out the HTTP action as follows:</p><p><br></p><p><strong>URI</strong>: {Your Halo URL}/api/Notify/AzureSentinel</p><p><br></p><p><strong>Method</strong>: POST</p><p><br></p><p><strong>Headers</strong>: Key = Authorization, Value = {“username:password” bas64 encoded}”.</p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImY0YzU5MjgxLWNhYjctNGE0Mi1iZTE3LWI3NDgyM2U3Njc1OSJ9.Llh0DbJCnAGsdzq44lHcWbSrV3PE3z5dfiDldXZed_g" width="556" style="width: 558px; height: 466.05px;" height="466" class="fr-fic fr-dii"></p><p><strong><span style="font-size: 10pt;">Fig 4. Parameters.</span></strong></p><p><br></p><p>For the body, press the lightning icon to add objects from the previous step, choosing the body of the Sentinel trigger:</p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6Ijk4NDQwOTBkLWM1N2YtNDk2Ny1iYzllLTlhNmE1NWZiZGYzOSJ9.n-ljCDW85MTHw_2RiDngy-UE1OdqjIzycXZc8GDQh7c" width="522" style="width: 524px; height: 124.762px;" height="125" class="fr-fic fr-dii"></p><p><strong><span style="font-size: 10pt;">Fig 5. Body.</span></strong></p><p><br></p><p>Save the Logic app.</p><p><br></p><p><strong><span style="font-size: 14pt;">Sentinel Automation Rules</span></strong></p><p>Navigate to the Microsoft Sentinel resource and select the “Automations” section under the “Configuration” group.</p><p><br></p><p>Create a new Automation rule for each of the following triggers:</p><p><br></p><ul><li>When incident is created</li><li>When incident is updated</li></ul><p><br></p><p>Add an action to “Run playbook” and choose the playbook that was made previously.</p><p><br></p><p><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6Ijc2MjkxZjg2LTRjZTktNGJjYi1hMDAwLWU1MDRiODUzMTg4MSJ9.EFBAnoT1IWCHE8Lt6YA1TBl9iSQ9ZtHgUTvZE5dMpd4" width="535" style="width: 537px; height: 371.769px;" height="372" class="fr-fic fr-dii"></p><p><strong><span style="font-size: 10pt;">Fig 6. Creating an automation rule.</span></strong></p><p><br></p><p>Save the automation rules.</p><p><br></p><p>Now whenever a Sentinel Incident is created or updated, the playbook will send a request to the Halo API and create/update a ticket in Halo.</p><p><br></p><p><strong><span style="font-size: 14pt;">Troubleshooting your Webhook</span></strong></p><p data-pasted="true">To identify errors with your Webhook you can try running the below report:</p><p><br></p><p style="margin-left: 20px;">SELECT top <span style="color: rgb(43, 155, 98);">100</span> * FROM integrationrequest</p><p style="margin-left: 20px;">WHERE IRMSiD = <span style="color: rgb(43, 155, 98);">275</span></p><p style="margin-left: 20px;">ORDER BY irid DESC</p><p> </p><p>This will show a record of your webhook. Since Microsoft requires a response to the API call faster than the authorisation can take place you will see the 200 "OK" response before the webhook arrives with the relevant details.</p>
