Microsoft Sentinel automation

Under Automation in Microsoft Sentinel, we create playbooks that can provide an automated response if an alert is triggered. Responses can vary from blocking and preventing threats to sending notifications, depending on the severity.

We can either create a playbook from scratch or select an existing template. Let's take a look at the templates and select Block AAD user – Alert, as in the following example:

Figure 8.12 – Playbook templates

If we select a template and choose to create a playbook, it will take us to a new blade. We need to select a subscription, resource group, region, and playbook name. An example is shown in the following screenshot:

Figure 8.13 – Automated response

Optionally, we can select to send diagnostics logs to Log Analytics and configure different integrations.

Next, we can see connectors that will be created for the playbook in question, as shown...