6: Automation Flashcards
(16 cards)
What is automation in Microsoft Sentinel?
It’s the use of workflows (called playbooks) to automatically respond to alerts or incidents without manual effort.
What is a playbook?
A workflow built in Azure Logic Apps that performs automated actions in response to an alert, incident, or manual trigger.
What kinds of actions can playbooks perform?
Enrich alerts with threat intel, send Teams or email notifications, create ServiceNow tickets, disable accounts, isolate machines, and more.
How are playbooks triggered in Sentinel?
Automatically by alerts or incidents, or manually by an analyst.
What tool powers playbooks in Sentinel?
Azure Logic Apps.
What’s an example use case for a playbook?
When a high-severity alert fires, a playbook can post to Teams, check IP reputation, and create a ticket—all automatically.
Why should customers care about automation in Sentinel?
It reduces analyst workload, speeds up response, ensures consistency, and minimizes the chance of human error.
Can playbooks be customized?
Yes, they are fully customizable and can also be created from templates in the Content Hub.
What skills are needed to build or modify a playbook?
No coding is required—playbooks are built with a drag-and-drop interface in Logic Apps.
Can I apply multiple playbooks to a single incident?
Yes, you can chain or layer multiple playbooks based on different conditions.
Can playbooks be triggered manually?
Yes, analysts can run playbooks manually from the incident view.
Do I need to know how to code to build a playbook?
No—Logic Apps use a visual designer with drag-and-drop components.
Can playbooks interact with third-party systems like ServiceNow?
Yes, using connectors, playbooks can integrate with many external systems.
Where do I go to view or manage playbooks?
Microsoft Sentinel > Automation.
Can I test a playbook before using it in production?
Yes, you can run them manually and view each step’s result during testing.
Can I edit a playbook after it’s created?
Yes, playbooks are editable at any time in Logic Apps.
