Secure MISP API key handling

[idoshabi07]

Summary

Uses secure-string parameters, removes the plaintext MISP key variable, references the secure parameter directly, and masks authenticated action data.

AI scan items

• https://dev.azure.com/MSecProductSecurity/AI%20Vuln%20Scanning/_workitems/edit/130099

Validation

ARM template JSON parsing passed.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the Sentinel-to-MISP Logic App ARM template to handle the MISP API key as a secure value and reduce secret exposure in run history.

Changes:

• Changes the MISP-Key parameter to a secure string type.
• Removes the plaintext MISPKey workflow variable and references the secure parameter directly in HTTP Authorization headers.
• Adds runtimeConfiguration.secureData to mask action inputs/outputs for authenticated HTTP actions.

Suppressed comments (1)

Playbooks/2S-Sentinel2MISP/MISP-Orchestrator/azuredeploy.json:1

• Using a secure value as a workflow definition parameter defaultValue can cause the secret to be persisted in the workflow definition payload at deploy time (and potentially retrievable by users with workflow read access). Prefer defining the workflow parameter as SecureString without a defaultValue, and pass the secret via the workflow resource’s parameters/value mechanism (or a Key Vault reference where supported) so the secret is stored/handled as a secret rather than embedded into the definition.

{

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.