Azure Sentinel：逻辑应用 Playbook 代码迁移到另一个租户

Question

我想将逻辑应用从一个租户迁移到另一个租户。

例如，这里是来自 Sentinel GitHub 的 Arm 模板 - 这就是我想要实现的目标。如何将您环境中的逻辑应用迁移到另一个环境。

我知道您可以复制粘贴代码视图，但是，连接和默认路径都链接到环境。您如何克服这个问题以及做到这一点的最佳实践是什么？

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "metadata": {
        "title": "Change Incident Severity", 
        "description": "This playbook will change Incident Severity based on specific username that is part of the Incident user entity.",
        "prerequisites": "After deployment, update condition action with user names to check for",
        "lastUpdateTime": "2021-06-03T00:00:00.000Z", 
        "entities": ["Account"], 
        "tags": ["Triage"], 
        "support": {
            "tier": "community" 
        },
        "author": {
            "name": "Yaniv Shasha"
        }
    },
    "parameters": {
        "PlaybookName": {
            "defaultValue": "Change-Incident-Severity",
            "type": "string"
        }
    },
    "variables": {
        "AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]"
    },
    "resources": [
        {
            "type": "Microsoft.Web/connections",
            "apiVersion": "2016-06-01",
            "name": "[variables('AzureSentinelConnectionName')]",
            "location": "[resourceGroup().location]",
            "kind": "V1",
            "properties": {
                "displayName": "[parameters('PlaybookName')]",
                "customParameterValues": {},
                "parameterValueType": "Alternative",
                "api": {
                    "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]"
                }
            }
        },
        {
            "type": "Microsoft.Logic/workflows",
            "apiVersion": "2017-07-01",
            "name": "[parameters('PlaybookName')]",
            "location": "[resourceGroup().location]",
            "tags": {
                "LogicAppsCategory": "security"
            },
            "identity": {
                "type": "SystemAssigned"
            },
            "dependsOn": [
                "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]"
            ],
            "properties": {
                "state": "Enabled",
                "definition": {
                    "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
                    "actions": {
                        "Entities_-_Get_Accounts": {
                            "inputs": {
                                "body": "@triggerBody()?['object']?['properties']?['relatedEntities']",
                                "host": {
                                    "connection": {
                                        "name": "@parameters('$connections')['azuresentinel']['connectionId']"
                                    }
                                },
                                "method": "post",
                                "path": "/entities/account"
                            },
                            "runAfter": {},
                            "type": "ApiConnection"
                        },
                        "For_each": {
                            "actions": {
                                "Condition": {
                                    "actions": {
                                        "Update_incident": {
                                            "inputs": {
                                                "body": {
                                                    "incidentArmId": "@triggerBody()?['object']?['id']",
                                                    "severity": "High"
                                                },
                                                "host": {
                                                    "connection": {
                                                        "name": "@parameters('$connections')['azuresentinel']['connectionId']"
                                                    }
                                                },
                                                "method": "put",
                                                "path": "/Incidents"
                                            },
                                            "runAfter": {},
                                            "type": "ApiConnection"
                                        }
                                    },
                                    "expression": {
                                        "or": [
                                            {
                                                "contains": [
                                                    "@items('For_each')?['Name']",
                                                    "admin"
                                                ]
                                            }
                                        ]
                                    },
                                    "runAfter": {},
                                    "type": "If"
                                }
                            },
                            "foreach": "@body('Entities_-_Get_Accounts')?['Accounts']",
                            "runAfter": {
                                "Entities_-_Get_Accounts": [
                                    "Succeeded"
                                ]
                            },
                            "type": "Foreach"
                        }
                    },
                    "contentVersion": "1.0.0.0",
                    "outputs": {},
                    "parameters": {
                        "$connections": {
                            "defaultValue": {},
                            "type": "Object"
                        }
                    },
                    "triggers": {
                        "Microsoft_Sentinel_incident": {
                            "inputs": {
                                "body": {
                                    "callback_url": "@{listCallbackUrl()}"
                                },
                                "host": {
                                    "connection": {
                                        "name": "@parameters('$connections')['azuresentinel']['connectionId']"
                                    }
                                },
                                "path": "/incident-creation"
                            },
                            "type": "ApiConnectionWebhook"
                        }
                    }
                },
                "parameters": {
                    "$connections": {
                        "value": {
                            "azuresentinel": {
                                "connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]",
                                "connectionName": "[variables('AzureSentinelConnectionName')]",
                                "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]",
                                "connectionProperties": {
                                    "authentication": {
                                        "type": "ManagedServiceIdentity"
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    ]
}

Answer 1

在探索您的需求后，我发现没有直接的方法可以在迁移过程中移动Azure资源（例如逻辑应用程序）的所有依赖项。

参考Q&A查看类似信息

有几种方法可以实现您的要求，如下所列。

1. 您可以在目标租户中创建一个新的 ARM 模板，其中包含 Api 连接等所有依赖配置，以使工作更轻松。

或

2. 使用 ARM 部署提供的模板后，我已使用 PowerShell 将其导出到现有代码目录。这允许将代码直接部署到目标租户，而不需要任何进一步的添加或修改。

已部署资源：

导出-AzResourceGroup PowerShell

$res1 = Get-AzResource -ResourceGroupName xxxx -ResourceName Change-Incident-Severity -ResourceType Microsoft.Logic/workflows
$res2 = Get-AzResource -ResourceGroupName xxxx -ResourceName azuresentinel-Change-Incident-Severity -ResourceType Microsoft.Web/connections
Export-AzResourceGroup -ResourceGroupName xxxx -Resource @($res1.ResourceId, $res2.ResourceId)

现在您可以使用相应的

az deployment

命令和所需的租户范围来部署它。

3.

从下面显示的现有租户导出并下载完整的 ARM 代码，其中包含所有连接和配置，然后继续在新租户中部署它。

参考：查看此博客以获取相关信息。