Book Image

Security Orchestration, Automation, and Response for Security Analysts

By : Benjamin Kovacevic
5 (1)
Book Image

Security Orchestration, Automation, and Response for Security Analysts

5 (1)
By: Benjamin Kovacevic

Overview of this book

What your journey will look like With the help of this expert-led book, you’ll become well versed with SOAR, acquire new skills, and make your organization's security posture more robust. You’ll start with a refresher on the importance of understanding cyber security, diving into why traditional tools are no longer helpful and how SOAR can help. Next, you’ll learn how SOAR works and what its benefits are, including optimized threat intelligence, incident response, and utilizing threat hunting in investigations. You’ll also get to grips with advanced automated scenarios and explore useful tools such as Microsoft Sentinel, Splunk SOAR, and Google Chronicle SOAR. The final portion of this book will guide you through best practices and case studies that you can implement in real-world scenarios. By the end of this book, you will be able to successfully automate security tasks, overcome challenges, and stay ahead of threats.
Table of Contents (14 chapters)
1
Part 1: Intro to SOAR and Its Elements
5
Part 2: SOAR Tools and Automation Hands-On Examples

Understanding the HTTP action and its usage

As already mentioned, all the Logic Apps actions that Microsoft Sentinel uses in playbooks are actually API calls. Native actions are just represented more nicely as part of a GUI, making it easier for users to utilize them. Adding dynamic content is much easier than writing the body of an API call in JSON.

But why, then, do I like the HTTP action more than any other? Because it allows us to create actions per our own needs, and we can also utilize different authentication methods.

Elements of the HTTP action

Firstly, what are the main elements of the HTTP action? Let’s look at them in the following list:

  • Method: This states the API method. The most popular are GET, POST, PATCH, PUT, and DELETE.
  • URI: The Uniform Resource Identifier (URI) is the API call itself. It normally looks like a URL.
  • Headers: This defines whether an API call needs to have any headers.
  • Queries: This defines whether the API call needs...