Download and Backup Your Azure Sentinel Playbooks

You may have noticed that depending on the existence (or non-existence) of certain connectors, you’re not able to export certain Playbooks (Logic Apps). You may see an error message similar to that in the next image.

Logic App Export

Some would like to still be able to back up their Logic Apps, but in my case, I want to be able to pull-down the Logic App to make the proper modifications to share my Playbook creations with others on my GitHub repo.

We have instructions for Templatizing Playbooks here: https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks#instructions-for-templatizing-a-playbook

To accomplish this, I built out the following PowerShell script to download the Playbook in .json format.

Get-LogicAppTemplate -LogicApp <LogicAppName> -ResourceGroup <ResourceGroup> -SubscriptionId <SubscriptionID> -Verbose | Out-File <C:\dir\filename.json>

To use it, you first need to install the LogicAppTemplate module. Run the following in PowerShell:

Install-Module -Name LogicAppTemplate

Once you’ve loaded the module, replace everything in brackets (<>) with your own values, i.e., Logic App name, Resource Group, Subscription ID, and destination directory.

You can also always grab the most current version from GitHub: https://github.com/rod-trent/SentinelPS/blob/master/Get-LogicApp2JSON.ps1

In a future post, I’ll share how I’m automating my “templatizing” using Visual Studio. Stay tuned…

[Want to discuss this further? Hit me up on Twitter or LinkedIn]

Author