{
    "definition": {
        "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
        "contentVersion": "1.0.0.0",
        "triggers": {
            "HTTP_Request": {
                "type": "Request",
                "kind": "Http",
                "inputs": {
                    "schema": {
                        "type": "object",
                        "properties": {
                            "urls": {
                                "type": "array"
                            },
                            "fileHashes": {
                                "type": "array"
                            },
                            "ips": {
                                "type": "array"
                            }
                        }
                    }
                }
            }
        },
        "actions": {
            "Initialize_EmailResults": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "EmailResults",
                            "type": "array",
                            "value": []
                        }
                    ]
                }
            },
            "Initialize_EmailTableHTML": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "EmailTableHTML",
                            "type": "string",
                            "value": ""
                        }
                    ]
                }
            },
            "Initialize_TIResults": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "TIResults",
                            "type": "array",
                            "value": []
                        }
                    ]
                }
            },
            "Initialize_TITableHTML": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "TITableHTML",
                            "type": "string",
                            "value": ""
                        }
                    ]
                }
            },
            "Initialize_KQLURLSectionHTML": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "KQLURLSectionHTML",
                            "type": "string",
                            "value": ""
                        }
                    ]
                }
            },
            "Initialize_KQLHashSectionHTML": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "KQLHashSectionHTML",
                            "type": "string",
                            "value": ""
                        }
                    ]
                }
            },
            "Initialize_KQLIPSectionHTML": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "KQLIPSectionHTML",
                            "type": "string",
                            "value": ""
                        }
                    ]
                }
            },
            "Condition_ValidateKey": {
                "actions": {
                    "For_each_URL_Email_And_TI": {
                        "foreach": "@triggerBody()?['urls']",
                        "actions": {
                            "Run_EmailUrl_KQL": {
                                "type": "ApiConnection",
                                "inputs": {
                                    "host": {
                                        "connection": {
                                            "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']"
                                        }
                                    },
                                    "method": "post",
                                    "body": "@concat('EmailUrlInfo | where TimeGenerated > ago(30d) | where Url has \"', item()?['Url'], '\" | join kind=leftouter (  EmailEvents | where TimeGenerated > ago(30d)   | project NetworkMessageId, SenderFromAddress, RecipientEmailAddress,     Subject, DeliveryAction, DeliveryLocation, ThreatTypes,     DetectionMethods, EmailDirection, LatestDeliveryAction,     LatestDeliveryLocation, TimeGenerated ) on NetworkMessageId | project TimeGenerated, Url, NetworkMessageId, SenderFromAddress,   RecipientEmailAddress, Subject, DeliveryAction, DeliveryLocation,   ThreatTypes, DetectionMethods, LatestDeliveryAction | order by TimeGenerated desc | take 20')",
                                    "path": "/queryData",
                                    "queries": {
                                        "subscriptions": "<AZURE-SUBSCRIPTION-ID>",
                                        "resourcegroups": "<RESOURCE-GROUP>",
                                        "resourcetype": "Log Analytics Workspace",
                                        "resourcename": "<LOG-ANALYTICS-WORKSPACE>",
                                        "timerange": "30d"
                                    }
                                }
                            },
                            "Run_EmailAttachment_KQL": {
                                "type": "ApiConnection",
                                "inputs": {
                                    "host": {
                                        "connection": {
                                            "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']"
                                        }
                                    },
                                    "method": "post",
                                    "body": "@concat('EmailUrlInfo | where TimeGenerated > ago(30d) | where Url has \"', item()?['Url'], '\" | distinct NetworkMessageId | join kind=leftouter (   EmailEvents   | where TimeGenerated > ago(30d)   | project NetworkMessageId, SenderFromAddress, RecipientEmailAddress,     Subject, DeliveryAction, DeliveryLocation, ThreatTypes ) on NetworkMessageId | join kind=leftouter (   EmailAttachmentInfo   | where TimeGenerated > ago(30d)   | project NetworkMessageId, FileName, FileType, SHA256,     ThreatNames ) on NetworkMessageId | project TimeGenerated = now(), SenderFromAddress, RecipientEmailAddress,   Subject, DeliveryAction, DeliveryLocation, ThreatTypes,   FileName, FileType, SHA256, ThreatNames | order by SenderFromAddress asc | take 10')",
                                    "path": "/queryData",
                                    "queries": {
                                        "subscriptions": "<AZURE-SUBSCRIPTION-ID>",
                                        "resourcegroups": "<RESOURCE-GROUP>",
                                        "resourcetype": "Log Analytics Workspace",
                                        "resourcename": "<LOG-ANALYTICS-WORKSPACE>",
                                        "timerange": "30d"
                                    }
                                }
                            },
                            "Run_TI_URL_KQL": {
                                "type": "ApiConnection",
                                "inputs": {
                                    "host": {
                                        "connection": {
                                            "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']"
                                        }
                                    },
                                    "method": "post",
                                    "body": "@concat('ThreatIntelligenceIndicator | where TimeGenerated > ago(14d) | where Active == true | where Url has \"', item()?['Url'], '\"   or DomainName has \"', item()?['Url'], '\" | project TimeGenerated, IndicatorId, ThreatType, ThreatSeverity,   ConfidenceScore, Url, DomainName, Description,   ExternalIndicatorId, Tags, SourceSystem, ExpirationDateTime | order by ThreatSeverity desc | take 10')",
                                    "path": "/queryData",
                                    "queries": {
                                        "subscriptions": "<AZURE-SUBSCRIPTION-ID>",
                                        "resourcegroups": "<RESOURCE-GROUP>",
                                        "resourcetype": "Log Analytics Workspace",
                                        "resourcename": "<LOG-ANALYTICS-WORKSPACE>",
                                        "timerange": "14d"
                                    }
                                }
                            },
                            "Append_URL_Email_Result": {
                                "runAfter": {
                                    "Run_EmailUrl_KQL": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ],
                                    "Run_EmailAttachment_KQL": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ]
                                },
                                "type": "AppendToArrayVariable",
                                "inputs": {
                                    "name": "EmailResults",
                                    "value": {
                                        "url": "@item()?['Url']",
                                        "emailUrlEvents": "@coalesce(body('Run_EmailUrl_KQL')?['value'], json('[]'))",
                                        "emailUrlCount": "@length(coalesce(body('Run_EmailUrl_KQL')?['value'], json('[]')))",
                                        "emailAttachmentEvents": "@coalesce(body('Run_EmailAttachment_KQL')?['value'], json('[]'))",
                                        "emailAttachmentCount": "@length(coalesce(body('Run_EmailAttachment_KQL')?['value'], json('[]')))"
                                    }
                                }
                            },
                            "Append_URL_Email_HTML_Row": {
                                "runAfter": {
                                    "Append_URL_Email_Result": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "EmailTableHTML",
                                    "value": "@concat('<tr style=\"background:#f9f9f9\"><td style=\"padding:6px 10px;border:1px solid #ddd;word-break:break-all;max-width:280px;font-family:monospace;font-size:11px\">', item()?['Url'], '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(greater(length(coalesce(body('Run_EmailUrl_KQL')?['value'], json('[]'))), 0), '#c0392b', '#27ae60'), '\">', string(length(coalesce(body('Run_EmailUrl_KQL')?['value'], json('[]')))), ' email(s)</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', if(greater(length(coalesce(body('Run_EmailUrl_KQL')?['value'], json('[]'))), 0), coalesce(body('Run_EmailUrl_KQL')?['value']?[0]?['RecipientEmailAddress'], 'Unknown'), '<em style=\"color:#888\">No email delivery found</em>'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', if(greater(length(coalesce(body('Run_EmailUrl_KQL')?['value'], json('[]'))), 0), coalesce(body('Run_EmailUrl_KQL')?['value']?[0]?['DeliveryAction'], 'Unknown'), '-'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px;color:', if(greater(length(coalesce(body('Run_EmailUrl_KQL')?['value'], json('[]'))), 0), '#c0392b', '#888'), '\">', if(greater(length(coalesce(body('Run_EmailUrl_KQL')?['value'], json('[]'))), 0), coalesce(body('Run_EmailUrl_KQL')?['value']?[0]?['ThreatTypes'], 'None detected'), '<em>—</em>'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(greater(length(coalesce(body('Run_EmailAttachment_KQL')?['value'], json('[]'))), 0), '#c0392b', '#888'), '\">', string(length(coalesce(body('Run_EmailAttachment_KQL')?['value'], json('[]')))), ' attach</td></tr>')"
                                }
                            },
                            "Append_URL_TI_Result": {
                                "runAfter": {
                                    "Run_TI_URL_KQL": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ]
                                },
                                "type": "AppendToArrayVariable",
                                "inputs": {
                                    "name": "TIResults",
                                    "value": {
                                        "entityType": "URL",
                                        "entityValue": "@item()?['Url']",
                                        "tiMatches": "@coalesce(body('Run_TI_URL_KQL')?['value'], json('[]'))",
                                        "tiMatchCount": "@length(coalesce(body('Run_TI_URL_KQL')?['value'], json('[]')))"
                                    }
                                }
                            },
                            "Append_URL_TI_HTML_Row": {
                                "runAfter": {
                                    "Append_URL_TI_Result": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "TITableHTML",
                                    "value": "@concat('<tr style=\"background:#f9f9f9\"><td style=\"padding:6px 10px;border:1px solid #ddd\">URL</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px;word-break:break-all;max-width:280px\">', item()?['Url'], '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(greater(length(coalesce(body('Run_TI_URL_KQL')?['value'], json('[]'))), 0), '#c0392b', '#27ae60'), '\">', string(length(coalesce(body('Run_TI_URL_KQL')?['value'], json('[]')))), ' match(es)</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', if(greater(length(coalesce(body('Run_TI_URL_KQL')?['value'], json('[]'))), 0), coalesce(body('Run_TI_URL_KQL')?['value']?[0]?['ThreatType'], 'Unknown'), '<em style=\"color:#888\">No TI matches</em>'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', if(greater(length(coalesce(body('Run_TI_URL_KQL')?['value'], json('[]'))), 0), string(coalesce(body('Run_TI_URL_KQL')?['value']?[0]?['ThreatSeverity'], 0)), '-'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', if(greater(length(coalesce(body('Run_TI_URL_KQL')?['value'], json('[]'))), 0), string(coalesce(body('Run_TI_URL_KQL')?['value']?[0]?['ConfidenceScore'], 0)), '-'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', if(greater(length(coalesce(body('Run_TI_URL_KQL')?['value'], json('[]'))), 0), coalesce(body('Run_TI_URL_KQL')?['value']?[0]?['Description'], '-'), '-'), '</td></tr>')"
                                }
                            },
                            "Compose_URL_KQL_Block": {
                                "runAfter": {
                                    "Append_URL_Email_HTML_Row": [
                                        "Succeeded",
                                        "Failed",
                                        "Skipped",
                                        "TimedOut"
                                    ],
                                    "Append_URL_TI_HTML_Row": [
                                        "Succeeded",
                                        "Failed",
                                        "Skipped",
                                        "TimedOut"
                                    ]
                                },
                                "type": "Compose",
                                "inputs": "@concat('<div style=\"border-left:4px solid #e74c3c;padding:10px 14px;margin-bottom:20px;background:#fdf5f5\"><strong style=\"color:#922b21;font-size:13px\">&#128140; URL: ', item()?['Url'], '</strong><br><br><strong style=\"font-size:12px;color:#c0392b\">&#128231; EmailUrlInfo &#8594; EmailEvents (30d lookback)</strong><br><span style=\"font-family:Consolas,Courier New,monospace;font-size:11px;color:#1c2833;white-space:pre\">EmailUrlInfo<br>| where TimeGenerated &gt; ago(30d)<br>| where Url has \"', item()?['Url'], '\"<br>| join kind=leftouter (<br>    EmailEvents<br>    | where TimeGenerated &gt; ago(30d)<br>    | project NetworkMessageId, SenderFromAddress, RecipientEmailAddress,<br>             Subject, DeliveryAction, DeliveryLocation, ThreatTypes,<br>             DetectionMethods, EmailDirection, LatestDeliveryAction,<br>             LatestDeliveryLocation, TimeGenerated<br>) on NetworkMessageId<br>| project TimeGenerated, Url, NetworkMessageId, SenderFromAddress,<br>         RecipientEmailAddress, Subject, DeliveryAction, DeliveryLocation,<br>         ThreatTypes, DetectionMethods, LatestDeliveryAction<br>| order by TimeGenerated desc<br>| take 20</span><br><br><strong style=\"font-size:12px;color:#c0392b\">&#128206; EmailUrlInfo &#8594; EmailEvents &#8594; EmailAttachmentInfo (30d lookback)</strong><br><span style=\"font-family:Consolas,Courier New,monospace;font-size:11px;color:#1c2833;white-space:pre\">EmailUrlInfo<br>| where TimeGenerated &gt; ago(30d)<br>| where Url has \"', item()?['Url'], '\"<br>| distinct NetworkMessageId<br>| join kind=leftouter (<br>    EmailEvents<br>    | where TimeGenerated &gt; ago(30d)<br>    | project NetworkMessageId, SenderFromAddress, RecipientEmailAddress,<br>             Subject, DeliveryAction, DeliveryLocation, ThreatTypes<br>) on NetworkMessageId<br>| join kind=leftouter (<br>    EmailAttachmentInfo<br>    | where TimeGenerated &gt; ago(30d)<br>    | project NetworkMessageId, FileName, FileType, SHA256, ThreatNames<br>) on NetworkMessageId<br>| project TimeGenerated = now(), SenderFromAddress, RecipientEmailAddress,<br>         Subject, DeliveryAction, DeliveryLocation, ThreatTypes,<br>         FileName, FileType, SHA256, ThreatNames<br>| order by SenderFromAddress asc<br>| take 10</span><br><br><strong style=\"font-size:12px;color:#c0392b\">&#127919; ThreatIntelligenceIndicator — URL/Domain (14d lookback)</strong><br><span style=\"font-family:Consolas,Courier New,monospace;font-size:11px;color:#1c2833;white-space:pre\">ThreatIntelligenceIndicator<br>| where TimeGenerated &gt; ago(14d)<br>| where Active == true<br>| where Url has \"', item()?['Url'], '\"<br>    or DomainName has \"', item()?['Url'], '\"<br>| project TimeGenerated, IndicatorId, ThreatType, ThreatSeverity,<br>         ConfidenceScore, Url, DomainName, Description,<br>         ExternalIndicatorId, Tags, SourceSystem, ExpirationDateTime<br>| order by ThreatSeverity desc<br>| take 10</span></div>')"
                            },
                            "Append_URL_KQL_Section": {
                                "runAfter": {
                                    "Compose_URL_KQL_Block": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "KQLURLSectionHTML",
                                    "value": "@outputs('Compose_URL_KQL_Block')"
                                }
                            }
                        },
                        "type": "Foreach",
                        "operationOptions": "Sequential"
                    },
                    "For_each_Hash_Email_And_TI": {
                        "foreach": "@triggerBody()?['fileHashes']",
                        "actions": {
                            "Run_HashEmail_KQL": {
                                "type": "ApiConnection",
                                "inputs": {
                                    "host": {
                                        "connection": {
                                            "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']"
                                        }
                                    },
                                    "method": "post",
                                    "body": "@concat('EmailAttachmentInfo | where TimeGenerated > ago(30d) | where SHA256 =~ \"', item()?['Value'], '\" | join kind=leftouter (  EmailEvents | where TimeGenerated > ago(30d)   | project NetworkMessageId, SenderFromAddress, RecipientEmailAddress,     Subject, DeliveryAction, DeliveryLocation, ThreatTypes,     DetectionMethods, LatestDeliveryAction, LatestDeliveryLocation ) on NetworkMessageId | project TimeGenerated, SHA256, FileName, FileType, ThreatNames,   SenderFromAddress, RecipientEmailAddress, Subject,   DeliveryAction, DeliveryLocation, ThreatTypes, LatestDeliveryAction | order by TimeGenerated desc | take 15')",
                                    "path": "/queryData",
                                    "queries": {
                                        "subscriptions": "<AZURE-SUBSCRIPTION-ID>",
                                        "resourcegroups": "<RESOURCE-GROUP>",
                                        "resourcetype": "Log Analytics Workspace",
                                        "resourcename": "<LOG-ANALYTICS-WORKSPACE>",
                                        "timerange": "30d"
                                    }
                                }
                            },
                            "Run_TI_Hash_KQL": {
                                "type": "ApiConnection",
                                "inputs": {
                                    "host": {
                                        "connection": {
                                            "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']"
                                        }
                                    },
                                    "method": "post",
                                    "body": "@concat('ThreatIntelligenceIndicator | where TimeGenerated > ago(14d) | where Active == true | where FileHashValue =~ \"', item()?['Value'], '\" | project TimeGenerated, IndicatorId, ThreatType, ThreatSeverity,   ConfidenceScore, FileHashValue, FileHashType, Description,   ExternalIndicatorId, Tags, SourceSystem, ExpirationDateTime | order by ThreatSeverity desc | take 10')",
                                    "path": "/queryData",
                                    "queries": {
                                        "subscriptions": "<AZURE-SUBSCRIPTION-ID>",
                                        "resourcegroups": "<RESOURCE-GROUP>",
                                        "resourcetype": "Log Analytics Workspace",
                                        "resourcename": "<LOG-ANALYTICS-WORKSPACE>",
                                        "timerange": "14d"
                                    }
                                }
                            },
                            "Append_Hash_Email_Result": {
                                "runAfter": {
                                    "Run_HashEmail_KQL": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ]
                                },
                                "type": "AppendToArrayVariable",
                                "inputs": {
                                    "name": "EmailResults",
                                    "value": {
                                        "hashValue": "@item()?['Value']",
                                        "hashAlgorithm": "@item()?['Algorithm']",
                                        "emailDeliveryEvents": "@coalesce(body('Run_HashEmail_KQL')?['value'], json('[]'))",
                                        "emailDeliveryCount": "@length(coalesce(body('Run_HashEmail_KQL')?['value'], json('[]')))"
                                    }
                                }
                            },
                            "Append_Hash_Email_HTML_Row": {
                                "runAfter": {
                                    "Append_Hash_Email_Result": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "EmailTableHTML",
                                    "value": "@concat('<tr style=\"background:#f0f8ff\"><td style=\"padding:6px 10px;border:1px solid #ddd;font-family:monospace;font-size:10px;word-break:break-all;max-width:280px\">', item()?['Value'], '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(greater(length(coalesce(body('Run_HashEmail_KQL')?['value'], json('[]'))), 0), '#c0392b', '#888'), '\">', string(length(coalesce(body('Run_HashEmail_KQL')?['value'], json('[]')))), ' email(s)</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', if(greater(length(coalesce(body('Run_HashEmail_KQL')?['value'], json('[]'))), 0), coalesce(body('Run_HashEmail_KQL')?['value']?[0]?['RecipientEmailAddress'], 'Unknown'), '<em style=\"color:#888\">Hash not found in email delivery</em>'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', if(greater(length(coalesce(body('Run_HashEmail_KQL')?['value'], json('[]'))), 0), coalesce(body('Run_HashEmail_KQL')?['value']?[0]?['DeliveryAction'], '-'), '-'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px;color:#c0392b\">', if(greater(length(coalesce(body('Run_HashEmail_KQL')?['value'], json('[]'))), 0), coalesce(body('Run_HashEmail_KQL')?['value']?[0]?['ThreatNames'], coalesce(body('Run_HashEmail_KQL')?['value']?[0]?['ThreatTypes'], 'None')), '-'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', item()?['Algorithm'], '</td></tr>')"
                                }
                            },
                            "Append_Hash_TI_Result": {
                                "runAfter": {
                                    "Run_TI_Hash_KQL": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ]
                                },
                                "type": "AppendToArrayVariable",
                                "inputs": {
                                    "name": "TIResults",
                                    "value": {
                                        "entityType": "FileHash",
                                        "entityValue": "@item()?['Value']",
                                        "tiMatches": "@coalesce(body('Run_TI_Hash_KQL')?['value'], json('[]'))",
                                        "tiMatchCount": "@length(coalesce(body('Run_TI_Hash_KQL')?['value'], json('[]')))"
                                    }
                                }
                            },
                            "Append_Hash_TI_HTML_Row": {
                                "runAfter": {
                                    "Append_Hash_TI_Result": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "TITableHTML",
                                    "value": "@concat('<tr style=\"background:#f9f9f9\"><td style=\"padding:6px 10px;border:1px solid #ddd\">Hash</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-family:monospace;font-size:10px;word-break:break-all;max-width:280px\">', item()?['Value'], '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(greater(length(coalesce(body('Run_TI_Hash_KQL')?['value'], json('[]'))), 0), '#c0392b', '#27ae60'), '\">', string(length(coalesce(body('Run_TI_Hash_KQL')?['value'], json('[]')))), ' match(es)</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', if(greater(length(coalesce(body('Run_TI_Hash_KQL')?['value'], json('[]'))), 0), coalesce(body('Run_TI_Hash_KQL')?['value']?[0]?['ThreatType'], 'Unknown'), '<em style=\"color:#888\">No TI matches</em>'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', if(greater(length(coalesce(body('Run_TI_Hash_KQL')?['value'], json('[]'))), 0), string(coalesce(body('Run_TI_Hash_KQL')?['value']?[0]?['ThreatSeverity'], 0)), '-'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', if(greater(length(coalesce(body('Run_TI_Hash_KQL')?['value'], json('[]'))), 0), string(coalesce(body('Run_TI_Hash_KQL')?['value']?[0]?['ConfidenceScore'], 0)), '-'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', if(greater(length(coalesce(body('Run_TI_Hash_KQL')?['value'], json('[]'))), 0), coalesce(body('Run_TI_Hash_KQL')?['value']?[0]?['Description'], '-'), '-'), '</td></tr>')"
                                }
                            },
                            "Compose_Hash_KQL_Block": {
                                "runAfter": {
                                    "Append_Hash_Email_HTML_Row": [
                                        "Succeeded",
                                        "Failed",
                                        "Skipped",
                                        "TimedOut"
                                    ],
                                    "Append_Hash_TI_HTML_Row": [
                                        "Succeeded",
                                        "Failed",
                                        "Skipped",
                                        "TimedOut"
                                    ]
                                },
                                "type": "Compose",
                                "inputs": "@concat('<div style=\"border-left:4px solid #e74c3c;padding:10px 14px;margin-bottom:20px;background:#fdf5f5\"><strong style=\"color:#922b21;font-size:13px\">&#129408; Hash (', item()?['Algorithm'], '): ', item()?['Value'], '</strong><br><br><strong style=\"font-size:12px;color:#c0392b\">&#128231; EmailAttachmentInfo &#8594; EmailEvents (30d lookback)</strong><br><span style=\"font-family:Consolas,Courier New,monospace;font-size:11px;color:#1c2833;white-space:pre\">EmailAttachmentInfo<br>| where TimeGenerated &gt; ago(30d)<br>| where SHA256 =~ \"', item()?['Value'], '\"<br>| join kind=leftouter (<br>    EmailEvents<br>    | where TimeGenerated &gt; ago(30d)<br>    | project NetworkMessageId, SenderFromAddress, RecipientEmailAddress,<br>             Subject, DeliveryAction, DeliveryLocation, ThreatTypes,<br>             DetectionMethods, LatestDeliveryAction, LatestDeliveryLocation<br>) on NetworkMessageId<br>| project TimeGenerated, SHA256, FileName, FileType, ThreatNames,<br>         SenderFromAddress, RecipientEmailAddress, Subject,<br>         DeliveryAction, DeliveryLocation, ThreatTypes, LatestDeliveryAction<br>| order by TimeGenerated desc<br>| take 15</span><br><br><strong style=\"font-size:12px;color:#c0392b\">&#127919; ThreatIntelligenceIndicator — File Hash (14d lookback)</strong><br><span style=\"font-family:Consolas,Courier New,monospace;font-size:11px;color:#1c2833;white-space:pre\">ThreatIntelligenceIndicator<br>| where TimeGenerated &gt; ago(14d)<br>| where Active == true<br>| where FileHashValue =~ \"', item()?['Value'], '\"<br>| project TimeGenerated, IndicatorId, ThreatType, ThreatSeverity,<br>         ConfidenceScore, FileHashValue, FileHashType, Description,<br>         ExternalIndicatorId, Tags, SourceSystem, ExpirationDateTime<br>| order by ThreatSeverity desc<br>| take 10</span></div>')"
                            },
                            "Append_Hash_KQL_Section": {
                                "runAfter": {
                                    "Compose_Hash_KQL_Block": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "KQLHashSectionHTML",
                                    "value": "@outputs('Compose_Hash_KQL_Block')"
                                }
                            }
                        },
                        "type": "Foreach",
                        "operationOptions": "Sequential"
                    },
                    "For_each_IP_TI": {
                        "foreach": "@triggerBody()?['ips']",
                        "actions": {
                            "Run_TI_IP_KQL": {
                                "type": "ApiConnection",
                                "inputs": {
                                    "host": {
                                        "connection": {
                                            "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']"
                                        }
                                    },
                                    "method": "post",
                                    "body": "@concat('ThreatIntelligenceIndicator | where TimeGenerated > ago(14d) | where Active == true | where NetworkIP =~ \"', item()?['Address'], '\"   or NetworkSourceIP =~ \"', item()?['Address'], '\"   or NetworkDestinationIP =~ \"', item()?['Address'], '\" | project TimeGenerated, IndicatorId, ThreatType, ThreatSeverity,   ConfidenceScore, NetworkIP, NetworkSourceIP, NetworkDestinationIP,   Description, ExternalIndicatorId, Tags, SourceSystem, ExpirationDateTime | order by ThreatSeverity desc | take 10')",
                                    "path": "/queryData",
                                    "queries": {
                                        "subscriptions": "<AZURE-SUBSCRIPTION-ID>",
                                        "resourcegroups": "<RESOURCE-GROUP>",
                                        "resourcetype": "Log Analytics Workspace",
                                        "resourcename": "<LOG-ANALYTICS-WORKSPACE>",
                                        "timerange": "14d"
                                    }
                                }
                            },
                            "Append_IP_TI_Result": {
                                "runAfter": {
                                    "Run_TI_IP_KQL": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ]
                                },
                                "type": "AppendToArrayVariable",
                                "inputs": {
                                    "name": "TIResults",
                                    "value": {
                                        "entityType": "IP",
                                        "entityValue": "@item()?['Address']",
                                        "tiMatches": "@coalesce(body('Run_TI_IP_KQL')?['value'], json('[]'))",
                                        "tiMatchCount": "@length(coalesce(body('Run_TI_IP_KQL')?['value'], json('[]')))"
                                    }
                                }
                            },
                            "Append_IP_TI_HTML_Row": {
                                "runAfter": {
                                    "Append_IP_TI_Result": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "TITableHTML",
                                    "value": "@concat('<tr style=\"background:#f9f9f9\"><td style=\"padding:6px 10px;border:1px solid #ddd;font-family:monospace\">IP</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-family:monospace\">', item()?['Address'], '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(greater(length(coalesce(body('Run_TI_IP_KQL')?['value'], json('[]'))), 0), '#c0392b', '#27ae60'), '\">', string(length(coalesce(body('Run_TI_IP_KQL')?['value'], json('[]')))), ' match(es)</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', if(greater(length(coalesce(body('Run_TI_IP_KQL')?['value'], json('[]'))), 0), coalesce(body('Run_TI_IP_KQL')?['value']?[0]?['ThreatType'], 'Unknown'), '<em style=\"color:#888\">No TI matches</em>'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', if(greater(length(coalesce(body('Run_TI_IP_KQL')?['value'], json('[]'))), 0), string(coalesce(body('Run_TI_IP_KQL')?['value']?[0]?['ThreatSeverity'], 0)), '-'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', if(greater(length(coalesce(body('Run_TI_IP_KQL')?['value'], json('[]'))), 0), string(coalesce(body('Run_TI_IP_KQL')?['value']?[0]?['ConfidenceScore'], 0)), '-'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', if(greater(length(coalesce(body('Run_TI_IP_KQL')?['value'], json('[]'))), 0), coalesce(body('Run_TI_IP_KQL')?['value']?[0]?['Description'], '-'), '-'), '</td></tr>')"
                                }
                            },
                            "Compose_IP_KQL_Block": {
                                "runAfter": {
                                    "Append_IP_TI_HTML_Row": [
                                        "Succeeded",
                                        "Failed",
                                        "Skipped",
                                        "TimedOut"
                                    ]
                                },
                                "type": "Compose",
                                "inputs": "@concat('<div style=\"border-left:4px solid #e74c3c;padding:10px 14px;margin-bottom:20px;background:#fdf5f5\"><strong style=\"color:#922b21;font-size:13px\">&#127760; IP: ', item()?['Address'], '</strong><br><br><strong style=\"font-size:12px;color:#c0392b\">&#127919; ThreatIntelligenceIndicator — IP (14d lookback)</strong><br><span style=\"font-family:Consolas,Courier New,monospace;font-size:11px;color:#1c2833;white-space:pre\">ThreatIntelligenceIndicator<br>| where TimeGenerated &gt; ago(14d)<br>| where Active == true<br>| where NetworkIP =~ \"', item()?['Address'], '\"<br>    or NetworkSourceIP =~ \"', item()?['Address'], '\"<br>    or NetworkDestinationIP =~ \"', item()?['Address'], '\"<br>| project TimeGenerated, IndicatorId, ThreatType, ThreatSeverity,<br>         ConfidenceScore, NetworkIP, NetworkSourceIP, NetworkDestinationIP,<br>         Description, ExternalIndicatorId, Tags, SourceSystem, ExpirationDateTime<br>| order by ThreatSeverity desc<br>| take 10</span></div>')"
                            },
                            "Append_IP_KQL_Section": {
                                "runAfter": {
                                    "Compose_IP_KQL_Block": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "KQLIPSectionHTML",
                                    "value": "@outputs('Compose_IP_KQL_Block')"
                                }
                            }
                        },
                        "type": "Foreach",
                        "operationOptions": "Sequential"
                    },
                    "Response_Success": {
                        "runAfter": {
                            "For_each_URL_Email_And_TI": [
                                "Succeeded",
                                "Failed",
                                "Skipped",
                                "TimedOut"
                            ],
                            "For_each_Hash_Email_And_TI": [
                                "Succeeded",
                                "Failed",
                                "Skipped",
                                "TimedOut"
                            ],
                            "For_each_IP_TI": [
                                "Succeeded",
                                "Failed",
                                "Skipped",
                                "TimedOut"
                            ]
                        },
                        "type": "Response",
                        "kind": "Http",
                        "inputs": {
                            "statusCode": 200,
                            "headers": {
                                "Content-Type": "application/json"
                            },
                            "body": {
                                "emailTableHTML": "@variables('EmailTableHTML')",
                                "tiTableHTML": "@variables('TITableHTML')",
                                "emailResults": "@variables('EmailResults')",
                                "tiResults": "@variables('TIResults')",
                                "kqlSectionHTML": "@concat(variables('KQLURLSectionHTML'), variables('KQLHashSectionHTML'), variables('KQLIPSectionHTML'))"
                            }
                        }
                    }
                },
                "runAfter": {
                    "Initialize_EmailResults": [
                        "Succeeded"
                    ],
                    "Initialize_EmailTableHTML": [
                        "Succeeded"
                    ],
                    "Initialize_TIResults": [
                        "Succeeded"
                    ],
                    "Initialize_TITableHTML": [
                        "Succeeded"
                    ],
                    "Initialize_KQLURLSectionHTML": [
                        "Succeeded"
                    ],
                    "Initialize_KQLHashSectionHTML": [
                        "Succeeded"
                    ],
                    "Initialize_KQLIPSectionHTML": [
                        "Succeeded"
                    ]
                },
                "else": {
                    "actions": {
                        "Response_Unauthorized": {
                            "type": "Response",
                            "kind": "Http",
                            "inputs": {
                                "statusCode": 401,
                                "body": {
                                    "error": "Unauthorized - invalid worker key"
                                }
                            }
                        }
                    }
                },
                "expression": {
                    "and": [
                        {
                            "equals": [
                                "@triggerOutputs()?['headers']?['x-worker-key']",
                                "@parameters('WorkerSharedKey')"
                            ]
                        }
                    ]
                },
                "type": "If"
            }
        },
        "outputs": {},
        "parameters": {
            "WorkerSharedKey": {
                "defaultValue": "<WORKER-SHARED-KEY>",
                "type": "String"
            },
            "$connections": {
                "type": "Object",
                "defaultValue": {}
            }
        }
    },
    "parameters": {
        "$connections": {
            "type": "Object",
            "value": {
                "azuremonitorlogs": {
                    "id": "/subscriptions/<AZURE-SUBSCRIPTION-ID>/providers/Microsoft.Web/locations/westus2/managedApis/azuremonitorlogs",
                    "connectionId": "/subscriptions/<AZURE-SUBSCRIPTION-ID>/resourceGroups/<RESOURCE-GROUP>/providers/Microsoft.Web/connections/azuremonitorlogs-1",
                    "connectionName": "azuremonitorlogs-1",
                    "connectionProperties": {}
                }
            }
        }
    }
}