You can also choose to run a playbook manually on-demand, as a response to a selected alert. They can also be run automatically in response to alerts, by telling the analytics rule to automatically run one or more playbooks when the alert is generated. Playbooks can be run automatically in response to incidents, by creating automation rules that call the playbooks as actions, as in the example above. ( Special permissions are required for this step.) It assigns the incident to the analyst tasked with managing this type of incident.įinally, it calls the playbook you just created. The rule changes the incident status to Active. In order to trigger the playbook, you'll then create an automation rule that runs when these incidents are generated. If the admins choose Ignore, the playbook closes the incident in Microsoft Sentinel, and the ticket in ServiceNow. If the admins choose Block, it sends a command to Microsoft Entra ID to disable the user, and one to the firewall to block the IP address. The playbook waits until a response is received from the admins, then continues with its next steps. The email message will include Block and Ignore user option buttons. It also sends all the information in the incident in an email message to your senior network admin and security admin. It sends a message to your security operations channel in Microsoft Teams or Slack to make sure your security analysts are aware of the incident. When the playbook is called by an automation rule passing it an incident, the playbook opens a ticket in ServiceNow or any other IT ticketing system. You start by creating a playbook that takes the following actions: Visit the Azure Logic Apps pricing page for more details.įor example, if you want to stop potentially compromised users from moving around your network and stealing information, you can create an automated, multifaceted response to incidents generated by rules that detect compromised users. Each playbook is created for the specific subscription to which it belongs, but the Playbooks display shows you all the playbooks available across any selected subscriptions.īecause playbooks make use of Azure Logic Apps, additional charges may apply. Playbooks in Microsoft Sentinel are based on workflows built in Azure Logic Apps, which means that you get all the power, customizability, and built-in templates of Logic Apps. It can also be run manually on-demand on specific incidents, alerts, or entities. A playbook can help automate and orchestrate your response, and can be set to run automatically when specific alerts are generated or when incidents are created or updated, by being attached to an automation rule. Playbooks are collections of procedures that can be run from Microsoft Sentinel in response to an entire incident, to an individual alert, or to a specific entity. They are also the mechanism by which you can run playbooks in response to incidents or alerts. You can use them to automatically assign incidents to the right personnel, close noisy incidents or known false positives, change their severity, and add tags.

What are automation rules and playbooks?Īutomation rules help you triage incidents in Microsoft Sentinel. For more information, see our How-to section, such as Automate threat response with playbooks in Microsoft Sentinel and Use triggers and actions in Microsoft Sentinel playbooks.

This tutorial provides basic guidance for a top customer task: creating automation to triage incidents.

Azure sentinel multi tenant