Workflow file for Sentinel-Deploy #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy Content to law-simon-ansible-sentinel-test01 [04291746-f9b4-4e5c-9549-a43572980a2b] | |
| # Note: This workflow will deploy everything in the root directory. | |
| # To deploy content only from a specific path (for example SentinelContent): | |
| # 1. Add the target path to the "paths" property like such | |
| # paths: | |
| # - 'SentinelContent/**' | |
| # - '!.github/workflows/**' | |
| # - '.github/workflows/sentinel-deploy-04291746-f9b4-4e5c-9549-a43572980a2b.yml' | |
| # 2. Append the path to the directory environment variable below | |
| # directory: '${{ github.workspace }}/SentinelContent' | |
| on: | |
| push: | |
| branches: [ main ] | |
| paths: | |
| - '**' | |
| - '!.github/workflows/**' # this filter prevents other workflow changes from triggering this workflow | |
| - '.github/workflows/sentinel-deploy-04291746-f9b4-4e5c-9549-a43572980a2b.yml' | |
| jobs: | |
| deploy-content: | |
| runs-on: windows-latest | |
| env: | |
| resourceGroupName: 'rg-simon-ansible-test' | |
| workspaceName: 'law-simon-ansible-sentinel-test01' | |
| workspaceId: '1b9853b3-054e-4573-8167-aa38cbf222e8' | |
| directory: '${{ github.workspace }}' | |
| cloudEnv: 'AzureCloud' | |
| contentTypes: 'AnalyticsRule,AutomationRule,HuntingQuery,Parser,Playbook,Workbook' | |
| branch: 'main' | |
| sourceControlId: '04291746-f9b4-4e5c-9549-a43572980a2b' | |
| rootDirectory: '${{ github.workspace }}' | |
| githubAuthToken: ${{ secrets.GITHUB_TOKEN }} | |
| smartDeployment: 'true' | |
| permissions: | |
| contents: write | |
| id-token: write # Require write permission to Fetch an OIDC token. | |
| steps: | |
| - name: Login to Azure (Attempt 1) | |
| continue-on-error: true | |
| id: login1 | |
| uses: azure/login@v2 | |
| with: | |
| client-id: ${{ secrets.AZURE_SENTINEL_CLIENTID_04291746f9b44e5c9549a43572980a2b }} | |
| tenant-id: ${{ secrets.AZURE_SENTINEL_TENANTID_04291746f9b44e5c9549a43572980a2b }} | |
| subscription-id: ${{ secrets.AZURE_SENTINEL_SUBSCRIPTIONID_04291746f9b44e5c9549a43572980a2b }} | |
| environment: 'AzureCloud' | |
| audience: api://AzureADTokenExchange | |
| enable-AzPSSession: true | |
| - name: Wait 30 seconds if login attempt 1 failed | |
| if: ${{ steps.login1.outcome=='failure' }} | |
| run: powershell Start-Sleep -s 30 | |
| - name: Login to Azure (Attempt 2) | |
| continue-on-error: true | |
| id: login2 | |
| uses: azure/login@v2 | |
| if: ${{ steps.login1.outcome=='failure' }} | |
| with: | |
| client-id: ${{ secrets.AZURE_SENTINEL_CLIENTID_04291746f9b44e5c9549a43572980a2b }} | |
| tenant-id: ${{ secrets.AZURE_SENTINEL_TENANTID_04291746f9b44e5c9549a43572980a2b }} | |
| subscription-id: ${{ secrets.AZURE_SENTINEL_SUBSCRIPTIONID_04291746f9b44e5c9549a43572980a2b }} | |
| environment: 'AzureCloud' | |
| audience: api://AzureADTokenExchange | |
| enable-AzPSSession: true | |
| - name: Wait 30 seconds if login attempt 2 failed | |
| if: ${{ steps.login2.outcome=='failure' }} | |
| run: powershell Start-Sleep -s 30 | |
| - name: Login to Azure (Attempt 3) | |
| continue-on-error: false | |
| id: login3 | |
| uses: azure/login@v2 | |
| if: ${{ steps.login2.outcome=='failure' }} | |
| with: | |
| client-id: ${{ secrets.AZURE_SENTINEL_CLIENTID_04291746f9b44e5c9549a43572980a2b }} | |
| tenant-id: ${{ secrets.AZURE_SENTINEL_TENANTID_04291746f9b44e5c9549a43572980a2b }} | |
| subscription-id: ${{ secrets.AZURE_SENTINEL_SUBSCRIPTIONID_04291746f9b44e5c9549a43572980a2b }} | |
| environment: 'AzureCloud' | |
| audience: api://AzureADTokenExchange | |
| enable-AzPSSession: true | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| - name: Deploy Content to Microsoft Sentinel | |
| uses: azure/powershell@v2 | |
| with: | |
| azPSVersion: 'latest' | |
| inlineScript: | | |
| ${{ github.workspace }}//.github/workflows/azure-sentinel-deploy-04291746-f9b4-4e5c-9549-a43572980a2b.ps1 |