Creating a simple Microsoft Sentinel playbook
This example will take you through the process of creating a new Microsoft Sentinel playbook. The scenario we are solving is notifying our security analysts, using Microsoft Teams that a new, high-severity incident has been created.
The first step is to create a new playbook that Microsoft Sentinel can use. Remember that for Microsoft Sentinel to be able to use a playbook, it must use the Microsoft Sentinel connector:
- Go to the Microsoft Sentinel playbook screen and click the Add Playbook button in the header. Follow the Creating a new playbook section to add a new playbook. I am calling this playbook
BookDemo. Select the appropriate resource group and location. For this example, you do not need to store information in Log Analytics. - Once your playbook has been created, click on the Blank Logic App button to create a new logic app that has nothing in it.
- On the Logic Apps Designer page, find and select the Microsoft Sentinel...
