Azure Compute v1.1.0

About the connector

Azure compute services are the hosting services responsible for hosting and running the application workloads. These include Azure Virtual Machines (VMs), Azure Container Service, Azure App Services, Azure Batch, and Azure ServiceFabric.

This document provides information about the Azure Compute Connector, which facilitates automated interactions, with an Azure Compute server using FortiSOAR™ playbooks. Add the Azure Compute Connector as a step in FortiSOAR™ playbooks and perform automated operations such as creating an instance, starting an instance, or retrieving a list of all instances.

Version information

Connector Version: 1.1.0

FortiSOAR™ Version Tested on: 7.2.0-914

Authored By: Fortinet

Certified: Yes

Release Notes for version 1.1.0

The following enhancements and bugs have been made to the Azure Compute Connector in version 1.1.0:

• Certified this version of the connector.
• Fixed an issue with the "Create an Instance" action that was failing with the "ResourceNotFound" error.

Getting Access Tokens

You can get authentication tokens to access the Azure Compute APIs using two methods:

• On behalf of the User – Delegate Permission.
• Without a User - Application Permission.

For more information, see https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview.

Getting Access Tokens using the On behalf of the user – Delegated Permission method

1. Ensure that the required permissions are granted for the registration of the application.
   For more information see, https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles?toc=/azure/virtual-network/toc.json#network-contributor.
   For example, for an Azure Subscriptions User: API/Permission name that should be granted is
   • Microsoft.Authorization/*/read
   • Microsoft.ClassicCompute/domainNames/*
   • Microsoft.ClassicCompute/virtualMachines/*
   • Microsoft.ClassicNetwork/networkSecurityGroups/join/action
   • Microsoft.ClassicNetwork/reservedIps/link/action
   • Microsoft.ClassicNetwork/reservedIps/read
   • Microsoft.ClassicNetwork/virtualNetworks/join/action
   • Microsoft.ClassicNetwork/virtualNetworks/read
   • Microsoft.ClassicStorage/storageAccounts/disks/read
   • Microsoft.ClassicStorage/storageAccounts/images/read
   • Microsoft.ClassicStorage/storageAccounts/listKeys/action
   • Microsoft.ClassicStorage/storageAccounts/read
   • Microsoft.Insights/alertRules/*
   • Microsoft.ResourceHealth/availabilityStatuses/read
   • Microsoft.Resources/deployments/*
   • Microsoft.Resources/subscriptions/resourceGroups/read
   • and Microsoft.Support/* of type 'Delegate'.
2. The Redirect URL can be directed to any web application in which you want to receive responses from Azure Compute. If you are unsure about what to set as a redirect URL, you can use https://localhost/myapp.
3. Copy the following URL and replace the TENANT_ID, CLIENT_ID, and REDIRECT_URI with your own tenant ID, client ID, and redirect URL: https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/authorize?response_type=code&scope=offline_access &client_id=CLIENT_ID&redirect_uri=REDIRECT_URI
4. Enter the above link with the replaced values and you will be prompted to grant permissions for your Azure Service Management. You will be automatically redirected to a link with the following structure: REDIRECT_URI?code=AUTH_CODE&session_state=SESSION_STATE
5. Copy the AUTH_CODE (without the "code=" prefix) and paste it into your instance configuration in the 'Authorization Code' parameter.
6. Enter your client ID in the 'Application (client) ID' parameter field.
7. Enter your client secret in the 'Application (client) Secret' parameter field.
8. Enter your tenant ID in the 'Directory (tenant) ID' parameter field.
9. Enter your redirect URL in the 'Redirect URL' parameter field. By default, it is set to https://localhost/myapp.

Getting Access Tokens using the Without a User - Application Permission method

1. Ensure that the required permissions are granted for the registration of the application.
   For more information see, https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles?toc=/azure/virtual-network/toc.json#network-contributor.
   For example, for an Azure Subscriptions Application User: API/Permission name that should be granted is
   • Microsoft.Authorization/*/read
   • Microsoft.ClassicCompute/domainNames/*
   • Microsoft.ClassicCompute/virtualMachines/*
   • Microsoft.ClassicNetwork/networkSecurityGroups/join/action
   • Microsoft.ClassicNetwork/reservedIps/link/action
   • Microsoft.ClassicNetwork/reservedIps/read
   • Microsoft.ClassicNetwork/virtualNetworks/join/action
   • Microsoft.ClassicNetwork/virtualNetworks/read
   • Microsoft.ClassicStorage/storageAccounts/disks/read
   • Microsoft.ClassicStorage/storageAccounts/images/read
   • Microsoft.ClassicStorage/storageAccounts/listKeys/action
   • Microsoft.ClassicStorage/storageAccounts/read
   • Microsoft.Insights/alertRules/*
   • Microsoft.ResourceHealth/availabilityStatuses/read
   • Microsoft.Resources/deployments/*
   • Microsoft.Resources/subscriptions/resourceGroups/read
   • and Microsoft.Support/* of type 'Application'.
2. Enter your client ID in the 'Application (client) ID' parameter field.
3. Enter your client secret in the 'Application (client) Secret' parameter field.
4. Enter your tenant ID in the 'Directory (tenant) ID' parameter field.

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the following yum command as a root user to install connectors from an SSH session:
yum install cyops-connector-azure-compute

Prerequisites to configuring the connector

• You must have acquired authentication tokens to access the Azure Compute APIs using 'Delegated' or 'Application' Permissions. For more information see the Getting Access Tokens section.
• Ensure that host login.microsoftonline.com on port 443 is in the allowlist of your Firewall or Proxy servers.

Configuring the connector

For the procedure to configure a connector, click here.

Configuration parameters

In FortiSOAR™, on the Content Hub (or Connector Store) page, click the Manage tab, and then click the Azure Compute connector card. On the connector popup, click the Configurations tab to enter the required configuration details.

Actions supported by the connector

The following automated operations can be included in playbooks and you can also use the annotations to access operations:

operation: Create an Instance

Input parameters

Output

The output contains the following populated JSON schema:
{
"name": "",
"id": "",
"type": "",
"location": "",
"properties": {
"vmId": "",
"hardwareProfile": {
"vmSize": ""
},
"storageProfile": {
"imageReference": {
"publisher": "",
"offer": "",
"sku": "",
"version": "",
"exactVersion": ""
},
"osDisk": {
"osType": "",
"name": "",
"createOption": "",
"caching": "",
"managedDisk": {
"storageAccountType": "",
"id": ""
},
"deleteOption": "",
"diskSizeGB": ""
},
"dataDisks": []
},
"osProfile": {
"computerName": "",
"adminUsername": "",
"linuxConfiguration": {
"disablePasswordAuthentication": "",
"provisionVMAgent": "",
"patchSettings": {
"patchMode": "",
"assessmentMode": ""
}
},
"secrets": [],
"allowExtensionOperations": "",
"requireGuestProvisionSignal": ""
},
"networkProfile": {
"networkInterfaces": [
{
"id": "",
"properties": {
"deleteOption": ""
}
}
]
},
"diagnosticsProfile": {
"bootDiagnostics": {
"enabled": ""
}
},
"provisioningState": "",
"timeCreated": ""
}
}

operation: List Instances

Input parameters

Output

The output contains the following populated JSON schema:
{
"name": "",
"id": "",
"type": "",
"location": "",
"properties": {
"vmId": "",
"hardwareProfile": {
"vmSize": ""
},
"storageProfile": {
"imageReference": {
"publisher": "",
"offer": "",
"sku": "",
"version": "",
"exactVersion": ""
},
"osDisk": {
"osType": "",
"name": "",
"createOption": "",
"caching": "",
"managedDisk": {
"storageAccountType": "",
"id": ""
},
"deleteOption": "",
"diskSizeGB": ""
},
"dataDisks": []
},
"osProfile": {
"computerName": "",
"adminUsername": "",
"linuxConfiguration": {
"disablePasswordAuthentication": "",
"provisionVMAgent": "",
"patchSettings": {
"patchMode": "",
"assessmentMode": ""
}
},
"secrets": [],
"allowExtensionOperations": "",
"requireGuestProvisionSignal": ""
},
"networkProfile": {
"networkInterfaces": [
{
"id": "",
"properties": {
"deleteOption": ""
}
}
]
},
"diagnosticsProfile": {
"bootDiagnostics": {
"enabled": ""
}
},
"provisioningState": "",
"timeCreated": ""
}
}

operation: Get Instance Info

Input parameters

Output

The output contains the following populated JSON schema:
{
"name": "",
"id": "",
"type": "",
"location": "",
"properties": {
"vmId": "",
"hardwareProfile": {
"vmSize": ""
},
"storageProfile": {
"imageReference": {
"publisher": "",
"offer": "",
"sku": "",
"version": "",
"exactVersion": ""
},
"osDisk": {
"osType": "",
"name": "",
"createOption": "",
"caching": "",
"managedDisk": {
"storageAccountType": "",
"id": ""
},
"deleteOption": "",
"diskSizeGB": ""
},
"dataDisks": []
},
"osProfile": {
"computerName": "",
"adminUsername": "",
"linuxConfiguration": {
"disablePasswordAuthentication": "",
"provisionVMAgent": "",
"patchSettings": {
"patchMode": "",
"assessmentMode": ""
}
},
"secrets": [],
"allowExtensionOperations": "",
"requireGuestProvisionSignal": ""
},
"networkProfile": {
"networkInterfaces": [
{
"id": "",
"properties": {
"deleteOption": ""
}
}
]
},
"diagnosticsProfile": {
"bootDiagnostics": {
"enabled": ""
}
},
"provisioningState": "",
"timeCreated": ""
}
}

operation: Start an Instance

Input parameters

Output

The output contains the following populated JSON schema:
{
"result": ""
}

operation: Stop an Instance

Input parameters

Output

The output contains the following populated JSON schema:
{
"result": ""
}

operation: Restart an Instance

Input parameters

Output

The output contains the following populated JSON schema:
{
"result": ""
}

operation: Delete an Instance

Input parameters

Output

The output contains the following populated JSON schema:
{
"result": ""
}

Included playbooks

The Sample - Azure Compute - 1.1.0 playbook collection comes bundled with the Azure Compute connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Azure Compute connector.

• Create an Instance
• Delete an Instance
• Get Instance Info
• List Instances
• Restart an Instance
• Start an Instance
• Stop an Instance

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during connector upgrade and delete.