Azure Function action

Azure functions can be called when an automation stitch is triggered. This example uses a Security Rating Summary trigger in the automation stitch.

To configure an Azure function automation stitch in the GUI:

1. Go to Security Fabric > Automation and click Create New.
2. Enter the stitch name.
3. Configure the trigger:
   1. Click Add Trigger.
   2. Click Create and select Security Rating Summary.
   3. Enter the following:

      Name	auto-azure
      Report	Security Posture

   4. Click OK.
   5. Select the trigger in the list and click Apply.
4. Configure the Azure Function action:
   1. Click Add Action.
   2. Click Create and select Azure Function.
   3. Enter the following:

      Name	azure_function
      URL	Enter the request API URI
      Authorization	Function
      API key	Enter the API key
      HTTP header	header1 : value1

   4. Click OK.
   5. Select the action in the list and click Apply.
5. Click OK.

To configure an Azure function automation stitch in the CLI:

1. Create an automation trigger:

   config system automation-trigger
       edit "auto-azure"
           set event-type security-rating-summary
       next
   end

2. Create an automation action:

   config system automation-action
       edit "azure_function"
           set action-type azure-function
           set azure-function-authorization function
           set azure-api-key **********
           set uri "xxxxx00-no-delete-xxxx.azurewebsites.net/api/headersResponse"
           set headers "header1:value1"
       next
   end

3. Create the automation stitch:

   config system automation-stitch
       edit "auto-azure"
           set trigger "auto-azure"
           config actions
               edit 1
                   set action "azure_function"
                   set required enable
               next
           end
       next
   end

When the automation stitch is triggered, the Security Fabric > Automation page shows the stitch trigger time. In Azure, the function log shows that the function was called, executed, and finished: