diff --git a/.github/workflows/sentinel-deploy-76f0e20c-abc1-4bab-ac5e-3adf4ec99a3e.yml b/.github/workflows/sentinel-deploy-76f0e20c-abc1-4bab-ac5e-3adf4ec99a3e.yml new file mode 100644 index 000000000..d9386ea5b --- /dev/null +++ b/.github/workflows/sentinel-deploy-76f0e20c-abc1-4bab-ac5e-3adf4ec99a3e.yml @@ -0,0 +1,81 @@ +name: Deploy Content to sentinel0 [76f0e20c-abc1-4bab-ac5e-3adf4ec99a3e] +# Note: This workflow will deploy everything in the root directory. +# To deploy content only from a specific path (for example SentinelContent): +# 1. Add the target path to the "paths" property like such +# paths: +# - 'SentinelContent/**' +# - '!.github/workflows/**' +# - '.github/workflows/sentinel-deploy-76f0e20c-abc1-4bab-ac5e-3adf4ec99a3e.yml' +# 2. Append the path to the directory environment variable below +# directory: '${{ github.workspace }}/SentinelContent' + +on: + push: + branches: [ main ] + paths: + - '**' + - '!.github/workflows/**' # this filter prevents other workflow changes from triggering this workflow + - '.github/workflows/sentinel-deploy-76f0e20c-abc1-4bab-ac5e-3adf4ec99a3e.yml' + +jobs: + deploy-content: + runs-on: windows-latest + env: + resourceGroupName: 'security_rg' + workspaceName: 'sentinel0' + workspaceId: '7e590f6b-68ee-4852-bbc9-19428a8a984c' + directory: '${{ github.workspace }}' + cloudEnv: 'AzureCloud' + creds: ${{ secrets.AZURE_SENTINEL_CREDENTIALS_76f0e20cabc14babac5e3adf4ec99a3e }} + contentTypes: 'AnalyticsRule,AutomationRule,HuntingQuery,Parser,Playbook,Workbook' + branch: 'main' + sourceControlId: '76f0e20c-abc1-4bab-ac5e-3adf4ec99a3e' + rootDirectory: '${{ github.workspace }}' + githubAuthToken: ${{ secrets.GITHUB_TOKEN }} + smartDeployment: 'true' + + steps: + - name: Login to Azure (Attempt 1) + continue-on-error: true + id: login1 + uses: azure/login@v1 + if: ${{ env.cloudEnv == 'AzureCloud' }} + with: + creds: ${{ secrets.AZURE_SENTINEL_CREDENTIALS_76f0e20cabc14babac5e3adf4ec99a3e }} + enable-AzPSSession: true + + - name: Wait 30 seconds if login attempt 1 failed + if: ${{ env.cloudEnv == 'AzureCloud' && steps.login1.outcome=='failure' }} + run: powershell Start-Sleep -s 30 + + - name: Login to Azure (Attempt 2) + continue-on-error: true + id: login2 + uses: azure/login@v1 + if: ${{ env.cloudEnv == 'AzureCloud' && steps.login1.outcome=='failure' }} + with: + creds: ${{ secrets.AZURE_SENTINEL_CREDENTIALS_76f0e20cabc14babac5e3adf4ec99a3e }} + enable-AzPSSession: true + + - name: Wait 30 seconds if login attempt 2 failed + if: ${{ env.cloudEnv == 'AzureCloud' && steps.login2.outcome=='failure' }} + run: powershell Start-Sleep -s 30 + + - name: Login to Azure (Attempt 3) + continue-on-error: false + id: login3 + uses: azure/login@v1 + if: ${{ env.cloudEnv == 'AzureCloud' && steps.login2.outcome=='failure' }} + with: + creds: ${{ secrets.AZURE_SENTINEL_CREDENTIALS_76f0e20cabc14babac5e3adf4ec99a3e }} + enable-AzPSSession: true + + - name: Checkout + uses: actions/checkout@v3 + + - name: Deploy Content to Azure Sentinel + uses: azure/powershell@v1 + with: + azPSVersion: 'latest' + inlineScript: | + ${{ github.workspace }}//.github/workflows/azure-sentinel-deploy-76f0e20c-abc1-4bab-ac5e-3adf4ec99a3e.ps1 \ No newline at end of file