Summary

This chapter introduced some common tips and tricks you can utilize when working with Microsoft Sentinel playbooks.

First, we introduced how to work with dynamic content and expressions and how to utilize the power of expressions to get data that is not exposed initially with dynamic content. This provides an easy and fast way to work with the data we get from any action.

After that, we focused on my favorite action – HTTP. The HTTP action allows you to connect to any service that runs on an API and functionalities that may not be available with native actions. In most cases, this will be when a native action doesn’t support using a service principal or managed identity for authentication, which we can utilize when using the HTTP action.

We finished the chapter by introducing a few actions that we didn’t use in examples but will make your day-to-day operations easier when working with Microsoft Sentinel playbooks. Some of them are action-setting...