{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {},
    "variables": {},
    "resources": [
        {
            "type": "Microsoft.Logic/workflows",
            "apiVersion": "2017-07-01",
            "name": "superna-zt-SO-Incident-Playbook-lockout",
            "location": "eastus",
            "identity": {
                "type": "SystemAssigned"
            },
            "properties": {
                "state": "Enabled",
                "definition": {
                    "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
                    "contentVersion": "1.0.0.0",
                    "parameters": {
                        "$connections": {
                            "defaultValue": {},
                            "type": "Object"
                        }
                    },
                    "triggers": {
                        "Microsoft_Sentinel_incident": {
                            "type": "ApiConnectionWebhook",
                            "inputs": {
                                "body": {
                                    "callback_url": "@{listCallbackUrl()}"
                                },
                                "host": {
                                    "connection": {
                                        "name": "@parameters('$connections')['azuresentinel']['connectionId']"
                                    }
                                },
                                "path": "/incident-creation"
                            }
                        }
                    },
                    "actions": {
                        "For_each": {
                            "foreach": "@triggerBody()?['object']?['properties']?['Alerts']",
                            "actions": {
                                "Compose": {
                                    "runAfter": {
                                        "Set_variable-cleanUsername": [
                                            "Succeeded"
                                        ]
                                    },
                                    "type": "Compose",
                                    "inputs": "@uriComponent(variables('cleanUsername'))"
                                },
                                "Compose2Username": {
                                    "runAfter": {
                                        "Parse_JSON_2_-_pass_the_custom_fields_in_the_alert_for_further_parsing": [
                                            "Succeeded"
                                        ]
                                    },
                                    "type": "Compose",
                                    "inputs": "@body('Parse_JSON_2_-_pass_the_custom_fields_in_the_alert_for_further_parsing')?['UserName']"
                                },
                                "Compose3-slash": {
                                    "runAfter": {
                                        "Compose2Username": [
                                            "Succeeded"
                                        ]
                                    },
                                    "type": "Compose",
                                    "inputs": "@replace(outputs('Compose2Username')[0], '\\\\\\\\', '\\\\')"
                                },
                                "Compose4-cleaned": {
                                    "runAfter": {
                                        "Compose3-slash": [
                                            "Succeeded"
                                        ]
                                    },
                                    "type": "Compose",
                                    "inputs": "@replace(outputs('Compose3-slash'), '\\\"', '')"
                                },
                                "Compose_-_get_custom_alerts_from_json_of_incident": {
                                    "runAfter": {},
                                    "type": "Compose",
                                    "inputs": "@items('For_each')?['properties']?['additionalData']?['Custom Details']"
                                },
                                "Parse_JSON_2_-_pass_the_custom_fields_in_the_alert_for_further_parsing": {
                                    "runAfter": {
                                        "Compose_-_get_custom_alerts_from_json_of_incident": [
                                            "Succeeded"
                                        ]
                                    },
                                    "type": "ParseJson",
                                    "inputs": {
                                        "content": "@outputs('Compose_-_get_custom_alerts_from_json_of_incident')",
                                        "schema": {
                                            "properties": {
                                                "AffectedProtocol": {
                                                    "items": {
                                                        "type": "string"
                                                    },
                                                    "type": "array"
                                                },
                                                "UserName": {
                                                    "items": {
                                                        "type": "string"
                                                    },
                                                    "type": "array"
                                                },
                                                "UserSID": {
                                                    "items": {
                                                        "type": "string"
                                                    },
                                                    "type": "array"
                                                },
                                                "hostIP": {
                                                    "items": {
                                                        "type": "string"
                                                    },
                                                    "type": "array"
                                                }
                                            },
                                            "type": "object"
                                        }
                                    }
                                },
                                "SendZT-Lockout": {
                                    "runAfter": {
                                        "Compose": [
                                            "Succeeded"
                                        ]
                                    },
                                    "type": "Http",
                                    "inputs": {
                                        "headers": {
                                            "Accept": "application/json",
                                            "Content-Type": "application/json",
                                            "api_key": "igls-yyyyyyy"
                                        },
                                        "method": "POST",
                                        "uri": "https://x.x.x.x/sera/v2/ransomware/lockout/@{outputs('Compose')}"
                                    }
                                },
                                "Send_an_email_(V2)_-_Send_email_to_log_zero_trust_action": {
                                    "runAfter": {
                                        "Compose": [
                                            "Succeeded"
                                        ]
                                    },
                                    "type": "ApiConnection",
                                    "inputs": {
                                        "body": {
                                            "Body": "<p>Cyber Storage Alert<br>\n<br>\n<br>\nUser ID of the locked out user @{variables('cleanUserName')}<br>\n<br>\nUrl encoded user name @{outputs('Compose')}</p>",
                                            "Importance": "High",
                                            "Subject": "Zero Trust user lockout",
                                            "To": "someemail@domain.com"
                                        },
                                        "host": {
                                            "connection": {
                                                "name": "@parameters('$connections')['office365']['connectionId']"
                                            }
                                        },
                                        "method": "post",
                                        "path": "/v2/Mail"
                                    }
                                },
                                "Set_variable-cleanUsername": {
                                    "runAfter": {
                                        "Compose4-cleaned": [
                                            "Succeeded"
                                        ]
                                    },
                                    "type": "SetVariable",
                                    "inputs": {
                                        "name": "cleanUserName",
                                        "value": "@{outputs('Compose4-cleaned')}"
                                    }
                                }
                            },
                            "runAfter": {
                                "Parse_JSON": [
                                    "Succeeded"
                                ]
                            },
                            "type": "Foreach"
                        },
                        "Initialize_variable_-cleanUserName": {
                            "runAfter": {},
                            "type": "InitializeVariable",
                            "inputs": {
                                "variables": [
                                    {
                                        "name": "cleanUserName",
                                        "type": "string"
                                    }
                                ]
                            }
                        },
                        "Parse_JSON": {
                            "runAfter": {
                                "Initialize_variable_-cleanUserName": [
                                    "Succeeded"
                                ]
                            },
                            "type": "ParseJson",
                            "inputs": {
                                "content": "@triggerBody()",
                                "schema": {
                                    "properties": {
                                        "body": {
                                            "properties": {
                                                "AlertDisplayName": {
                                                    "type": "string"
                                                },
                                                "AlertName": {
                                                    "type": "string"
                                                },
                                                "AlertType": {
                                                    "type": "string"
                                                },
                                                "Description": {
                                                    "type": "string"
                                                },
                                                "EndTimeUtc": {
                                                    "type": "string"
                                                },
                                                "Entities": {
                                                    "type": "array"
                                                },
                                                "ExtendedLinks": {
                                                    "type": "array"
                                                },
                                                "ExtendedProperties": {
                                                    "properties": {
                                                        "Alert generation status": {
                                                            "type": "string"
                                                        },
                                                        "Analytic Rule Ids": {
                                                            "type": "string"
                                                        },
                                                        "Analytic Rule Name": {
                                                            "type": "string"
                                                        },
                                                        "Correlation Id": {
                                                            "type": "string"
                                                        },
                                                        "Custom Details": {
                                                            "type": "string"
                                                        },
                                                        "Data Sources": {
                                                            "type": "string"
                                                        },
                                                        "Event Grouping": {
                                                            "type": "string"
                                                        },
                                                        "ProcessedBySentinel": {
                                                            "type": "string"
                                                        },
                                                        "Query": {
                                                            "type": "string"
                                                        },
                                                        "Query End Time UTC": {
                                                            "type": "string"
                                                        },
                                                        "Query Period": {
                                                            "type": "string"
                                                        },
                                                        "Query Start Time UTC": {
                                                            "type": "string"
                                                        },
                                                        "Search Query Results Overall Count": {
                                                            "type": "string"
                                                        },
                                                        "Trigger Operator": {
                                                            "type": "string"
                                                        },
                                                        "Trigger Threshold": {
                                                            "type": "string"
                                                        }
                                                    },
                                                    "type": "object"
                                                },
                                                "ProductName": {
                                                    "type": "string"
                                                },
                                                "ProviderAlertId": {
                                                    "type": "string"
                                                },
                                                "ProviderName": {
                                                    "type": "string"
                                                },
                                                "RemediationSteps": {
                                                    "type": "string"
                                                },
                                                "Severity": {
                                                    "type": "string"
                                                },
                                                "StartTimeUtc": {
                                                    "type": "string"
                                                },
                                                "SystemAlertId": {
                                                    "type": "string"
                                                },
                                                "TimeGenerated": {
                                                    "type": "string"
                                                },
                                                "WorkspaceId": {
                                                    "type": "string"
                                                },
                                                "WorkspaceResourceGroup": {
                                                    "type": "string"
                                                },
                                                "WorkspaceSubscriptionId": {
                                                    "type": "string"
                                                }
                                            },
                                            "type": "object"
                                        },
                                        "headers": {
                                            "properties": {
                                                "Accept": {
                                                    "type": "string"
                                                },
                                                "Accept-Encoding": {
                                                    "type": "string"
                                                },
                                                "Accept-Language": {
                                                    "type": "string"
                                                },
                                                "CLIENT-IP": {
                                                    "type": "string"
                                                },
                                                "Content-Length": {
                                                    "type": "string"
                                                },
                                                "Content-Type": {
                                                    "type": "string"
                                                },
                                                "DISGUISED-HOST": {
                                                    "type": "string"
                                                },
                                                "Host": {
                                                    "type": "string"
                                                },
                                                "Max-Forwards": {
                                                    "type": "string"
                                                },
                                                "Origin": {
                                                    "type": "string"
                                                },
                                                "Sec-Fetch-Dest": {
                                                    "type": "string"
                                                },
                                                "Sec-Fetch-Mode": {
                                                    "type": "string"
                                                },
                                                "Sec-Fetch-Site": {
                                                    "type": "string"
                                                },
                                                "User-Agent": {
                                                    "type": "string"
                                                },
                                                "WAS-DEFAULT-HOSTNAME": {
                                                    "type": "string"
                                                },
                                                "X-ARR-LOG-ID": {
                                                    "type": "string"
                                                },
                                                "X-ARR-SSL": {
                                                    "type": "string"
                                                },
                                                "X-AppService-Proto": {
                                                    "type": "string"
                                                },
                                                "X-Forwarded-For": {
                                                    "type": "string"
                                                },
                                                "X-Forwarded-Proto": {
                                                    "type": "string"
                                                },
                                                "X-Forwarded-TlsVersion": {
                                                    "type": "string"
                                                },
                                                "X-Original-URL": {
                                                    "type": "string"
                                                },
                                                "X-SITE-DEPLOYMENT-ID": {
                                                    "type": "string"
                                                },
                                                "X-WAWS-Unencoded-URL": {
                                                    "type": "string"
                                                },
                                                "x-ms-client-request-id": {
                                                    "type": "string"
                                                },
                                                "x-ms-client-session-id": {
                                                    "type": "string"
                                                },
                                                "x-ms-client-tracking-id": {
                                                    "type": "string"
                                                },
                                                "x-ms-effective-locale": {
                                                    "type": "string"
                                                }
                                            },
                                            "type": "object"
                                        }
                                    },
                                    "type": "object"
                                }
                            }
                        }
                    },
                    "outputs": {}
                },
                "parameters": {
                    "$connections": {
                        "value": {
                            "azuresentinel": {
                                "connectionId": "[concat('/subscriptions/', subscription().subscriptionId,'/providers/Microsoft.Web/locations/eastus/managedApis/azuresentinel')]",
                                "connectionName": "azuresentinel-superna-zt-SO-Incident-Playbook",
                                "connectionProperties": {
                                    "authentication": {
                                        "type": "ManagedServiceIdentity"
                                    }
                                }
                            },
                            "office365": {
                                "connectionId": "[concat('/subscriptions/', subscription().subscriptionId,'/providers/Microsoft.Web/connections/office365')]",
                                "connectionName": "office365",
                                "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/eastus/managedApis/office365')]"
                            }
                        }
                    }
                }
            }
        }
    ]
}