# Installation

> This article describes how to install the ReversingLabs Content Pack for Microsoft Sentinel

## Overview

Learn how to install the ReversingLabs Content Pack for Microsoft Sentinel and get started
with specially crafted Microsoft Sentinel resources to enrich your SOC experience.

## Prerequisites

To use resources included with the ReversingLabs Content Pack, you should have valid
credentials for either ReversingLabs Spectra Intelligence or a Spectra Analyze API token.

**Tip: Did you know?**
You can purchase a license for Spectra Intelligence enrichment APIs directly in
the Azure Marketplace. [View the offer details](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/reversinglabs1597673283347.rl_offer_saas_sentinel_enrich_api?tab=Overview)

## Installation

To begin using the provided content, the solution must first be installed from the Microsoft Sentinel content hub.

The solution is made available in the Microsoft Sentinel content hub. The content hub is found under the “Content management” menu header in the Microsoft Sentinel resource blade:

![Microsoft Sentinel Content Hub menu location screenshot](../images/ch-install1.png)

In the search bar, enter "ReversingLabs", then click the "ReversingLabs Content Pack". Click Install to begin.

![ReversingLabs Content Pack search result in marketplace](../images/ch-install2.png)

## Playbook Setup

Several Microsoft Sentinel playbooks are included with the solution. These are available as deployable templates. After deploying a playbook, credentials will need to be configured to access ReversingLabs products.

**Deploy a playbook template**

To set up a playbook, first deploy the template from the content pack.

1. From the content pack manager, select a playbook.
2. Click the "configuration" button.

![Content Pack Manager with configuration button highlighted](../images/ch-install3.png)

3. Click "create playbook" to start the deployment
4. Enter the following information in the deployment menu:

    - **Subscription**: this is the subscription where the target Microsoft Sentinel instance is located.
    - **Resource group**: this is the resource group where the target Microsoft Sentinel instance is located.
    - **Playbook name**: customize the playbook name, if necessary. We recommend leaving this as the default value.
    - **Enable diagnostics logs in Log Analytics**: this option enables diagnostics logs for the logic app, including events such as failures and runtime metrics. We recommend enabling this option. If this option is enabled, select a log analytics workspace from the dropdown.

5. (Spectra Analyze playbooks) After filling in the settings, click “Next: Parameters” and enter a valid Spectra Analyze instance URL in the format `https://<hostname>`
6. Click "Next: Connections" and either select existing Logic App connections or leave default to create a new connection.
7. Click Create to finalize the deployment.

**Authorize connectors**

If this is the first time a ReversingLabs playbook has been deployed, API connections will need to be created for the associated Logic App connectors.

1. Open the Logic App resource, then click "Logic App Designer"
2. Click the "Errors" button to view the operations that required updating:

![Logic App Designer with Errors button visible](../images/ch-install4.png)

For details on setting up the Microsoft Sentinel connector, see the following documentation: https://learn.microsoft.com/azure/sentinel/automation/authenticate-playbooks-to-sentinel

### Authorizing the Spectra Intelligence connector

To authorize the Spectra Intelligence connector, provide the following parameters:

    - **Connection Name**: a friendly name for the connection
    - **Username**: the username used to authenticate to Spectra Intelligence
    - **Password**: the password used to authenticate to Spectra Intelligence

![Spectra Intelligence connector authorization form](../images/ch-install5.png)

### Authorizing the Spectra Analyze connector

To authorize the Spectra Analyze connector, provide the following parameters:

    - **Connection Name**: a friendly name for the connection
    - **Token**: the API token used to authenticate to the Spectra Analyze API, in the format `Token <your token value>`
    - **A1000 Host URL**: the URL of the Spectra Analyze appliance, in the format `https://<hostname>`

**Warning: The API token **MUST** be in the following format: `Token <your token value>`**


![Spectra Analyze connector authorization form with token field](../images/ch-install6.png)

## Workbook Setup

A workbook is included that helps to visualize value provided by threat intelligence feeds and
automation with ReversingLabs.

**Install the Workbook**

1. Navigate to the ReversingLabs content pack manager

2. Select the checkbox next to "ReversingLabs-CapabilitiesOverview", then click "Configuration"

![Content Pack Manager with workbook selection checkbox](../images/ch-install7.png)

3. In the next page, click "save", select a region, then save again

![Workbook configuration dialog with region selection](../images/ch-install8.png)

4. Once the workbook is saved, click "View saved workbook"

**Configure the workbook**

The workbook must be configured to point to a valid Azure subscription and Microsoft Sentinel workspace.

1.  Click the “Subscription” parameter bubble, then select the subscription containing the Microsoft Sentinel workspace.
2.  Click the “Workspace” parameter bubble and select the target Microsoft Sentinel workspace.
3.  The workbook should automatically refresh and show data if available.
4.	Click the “Save” icon to save the workbook with these updated settings; the workbook has now been fully deployed.

![Workbook subscription and workspace parameter selection interface](../images/ch-install9.png)

**Enable quota usage metrics**

For Spectra Intelligence (formerly TitaniumCloud) users with a valid license or users that have subscribed to the Azure Marketplace offer ReversingLabs File Enrichment APIs, the workbook can be configured to monitor API quotas and view API usage.

Ensure that this playbook has been deployed before proceeding.

1.	Click the “API Usage” tab.
2.	Copy the ArmAction path of the playbook using the format below
3.	Replace the highlighted values with an Azure subscription ID and resource group name:

```
/subscriptions/<subscription_id>/resourceGroups/<resource_group_name>/providers/Microsoft.Logic/workflows/ReversingLabs-CheckQuota/triggers/manual/run?api-version=2016-06-01
```

4. With the path copied, click the “edit” button in the workbook menu, then click the advanced editor button:

![Workbook edit button and advanced editor button menu](../images/ch-install10.png)

5.	In the advanced editor, press Control + F on the keyboard to open the search prompt. Enter the ID: **`b9059e5f-55bb-4e6d-9745-f7fe6497824d`**
6.	There will be two ArmAction objects with empty path items as shown below. Paste the ArmAction path previously mentioned here:

![Advanced editor showing ArmAction objects with empty path items](../images/ch-install11.png)

7. Save the workbook to finalize the configuration.

**Checking connectivity and API usage**

After completing the workbook configuration, it is recommended to test connectivity.

1. Click the "API Usage" tab in the workbook.
2. Click the "Check quotas" button.
3. An ARM action blade will slide out from the right side of the screen. Click the "Run ARM action" button to continue.

![API Usage tab with Check Quotas button and Run ARM action option](../images/ch-install12.png)

4. After a few minutes, click the workbook refresh button to reload the workbook.
5. The workbook panel should automatically update and present the following information:

   - **Timestamp**: UTC timestamp of the last ReversingLabs-CheckQuota playbook run
   - **Connection status**: shows 'connected' for successful connection to the Spectra Analyze API or 'error'
   - **API User**: the TitaniumCloud user configured in the ReversingLabs-CheckQuota playbook

![Workbook API usage panel displaying connection status and quota information](../images/ch-install13.png)

## Upgrading

The Microsoft Sentinel Content Hub will indicate when a new version is available for installation.
To upgrade, select the solution and click the "Actions" button, and then "Update".

Note that upgrades to the solution will only update the deployment templates and not any resources previously deployed.
