[OSCD Initiative] Add Azure Authentication Token Revokation Responder

[districtofpaige]

Hello, please see the supplied AzureTokenRevoker responder .py, .json, and requirements.txt files.

Two outstanding issues within the responder's .py codew:
1.) I was not able to clear up, is what the get_params data path was for a submitted UPN within a case. Would it be "data.data"? Or something else?

2.) Will a self.report statement with a message be sufficient as a return of success? Or is there some other object I should be passing back to TheHive?

[yugoslavskiy]

Hello @Dmweiner! Sorry for the delayed reply. We still work on the OSCD sprint finalization.
Let's try to tag the maintainers and get your questions answered!

@nadouani @jeromeleonard guys could you please give us a hand?

[nadouani]

Hello, please see the supplied AzureTokenRevoker responder .py, .json, and requirements.txt files.

Two outstanding issues within the responder's .py codew:
1.) I was not able to clear up, is what the get_params data path was for a submitted UPN within a case. Would it be "data.data"? Or something else?

2.) Will a self.report statement with a message be sufficient as a return of success? Or is there some other object I should be passing back to TheHive?

Hello @Dmweiner

1/ using data.data you get access to the case send by TheHive to the responder. Where do you store the UPN within a case?
2/ technically this is enough, I would return an operation like adding a tag to the case or observable.