[OSCD Initiative] Develop Responder for Azure Active Directory

[yugoslavskiy]

Feature description

Responder for Azure Active Directory (AAD) that would be able to execute the following Response Actions:

• RA4601: Revoke authentication credentials (API tokens)

Describe the solution you'd like

This could be done via Revoke-AzureADUserAllRefreshToken cmdlet.

[districtofpaige]

I am going to attempt to tackle this using the Graph API: POST /users/{id | userPrincipalName}/revokeSignInSessions.

[districtofpaige]

So I've written the responder python script, json config file, and requirements.txt. I'm trying to import the responder into my cortex VM and I am able to get the responder to show up in the web gui, but the config never shows up. Is there something I'm missing?

[nadouani]

Hello @Dmweiner what do you mean by but the config never shows up? It is it the responder enable modal that doesn't show the configuration form? or the Responder Configuration tab doesn't list your responder?

Can you share the .json file?

[districtofpaige]

Hi @nadouani , appreciate the help.

After adding the path of the responder python code, json service file, and requirements.txt to the cortex config, the json configuration settings for the responder don't show up in the configuration form or in the responder configuration page.

AzureTokenRevoker.zip

[nadouani]

How did you configure that in Cortex config file? How do you tell Cortex about your responder?

Your responder's config file looks correct. I'll try it and let you know.

[nadouani]

Yeah, after some checking, there is a parsing error on the last configuration items. type list is not valid. The users configuration items needs to have a string type instead of list.

[districtofpaige]

That is extremely helpful! Thanks!

[districtofpaige]

@nadouani Sorry to eat up your time, but what is the easiest way to test a responder? I have something written that I'm sure has some issues I need to iron out but I have not had luck running it.

Using a configured training VM, I'm having issues with getting the hive to see enabled responders in a linked cortex instance.

I'm also having trouble using the utility script analyzer-runlocal to test the responder because I don't know what the format of a job file should look like.

Any pointers on my approaches to debugging the responder?
AzureTokenRevoker Complete.zip

[nadouani]

@Dmweiner can you put your responder on a github repository so I can help you review it? You seem to have a typo in your dataListType: ("thehive:case_artifact:" has an extra : and is not valid, so TheHive cannot see it)

[nadouani]

The operations function is also invalid, since it has to return an array of operations. You can double check other responders to see how it works

[districtofpaige]

Sure thing, it will take a minute since I am new to github. I'll make sure to upload the most recent json file as you found that data type problem earlier this weekend :).

[districtofpaige]

@nadouani See uploaded repositories here

[nadouani]

Hello @Dmweiner here are my comments:

• the responder should be used on thehive:case_artifact only (update the dataTypeList in the json definition file)
• you need to check the observable's dataType using data.dataType (the responder will receive the user email as the data of the observable data). I would check for data.dataType == "mail"
• I'm not sure that adding a tag including a timestamp is a good idea, because it will generate a significant number of distinct tags

[districtofpaige]

Thank you, I was unsure of what dataType it should be.

I will update the python script accordingly.

What would be an acceptable output for the script? Can I just return a success message as discussed in the building your own responder guide?

[yugoslavskiy]

Hello @Dmweiner! Sorry for the delayed response, we still finalizing OSCD-related PRs in the other projects.
I think you can return a simple success message (:
Could you please create PR so we could proceed with discussion there, reviewing the code?
Thank you!

[districtofpaige]

Sure thing, will do it now!

…

On Sat, Nov 21, 2020 at 12:30 PM yugoslavskiy ***@***.***> wrote: Hello @Dmweiner <https://github.com/Dmweiner>! Sorry for the delayed response, we still finalizing OSCD-related PRs in the other projects. I think you can return a simple success message (: Could you please create PR so we could proceed with discussion there, reviewing the code? Thank you! — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#858 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ARHEVWGJWC5LRMBS4NKOUU3SQ72K7ANCNFSM4RL55KPA> .

[2Wanderer]

Hi, i realy like to leverage this responder but it looks like i'm also missing the users field:

the error it throws after running:

I'm using the docker neurons