attackthesoc.comarticleOperational Workbooks Episode 1: Running a Playbook from a Workbook
A hands-on guide to wiring Microsoft Sentinel Workbooks to Logic Apps (playbooks) using the ARM Action link and HTTP request trigger, allowing analysts to export arbitrary workbook column data as parameters and POST it to a playbook without requiring an Incident/Entity ID. The author flags that this pipes untrusted attacker-controlled data (URLs, command lines) into downstream automation, and notes example WAF/XSS events can trigger HTML injection directly in the workbook via the URI parameter.
TL;DR Walkthrough of triggering Sentinel Logic App playbooks from arbitrary Workbook data via ARM Actions, with a warning about injecting untrusted attack data into automation.
Organisations named here
- Azure WAF workbook
Technologies named here
- Microsoft Sentinel
- Microsoft Sentinel Workbooks
- Azure Logic Apps
- Azure Resource Graph
- Azure Firewall
- Workbook ARM Action
- Parse JSON action
- Azure WAF
- FreshDesk
- Azure Resource Manager
Techniques named here
- HTML injection via URI parameter in a workbook
Related in Blue Team & Detection
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
huntress.comwriteup