Creating Playbooks & Logic Apps (part 1)

 

To read part 2, please click here

To read part 3, please click here

To read part 4, please click here

Introduction to Microsoft Sentinel Playbooks

A Microsoft Sentinel playbook can be considered as a logic app using the Microsoft Sentinel connector to trigger the workflow. The logic app connectors offers access to events and data while actions performs some special tasks like sending an email, posting a message on Microsoft Teams, extracting JavaScript Object Notation (JSON) objects, and whatnot.

The Microsoft Sentinel playbooks already have a rich ecosystem of connectors as well as actions with the help of Azure Logic Apps as the backend technology, that they can call upon to perform their activities. 

Overview of the Microsoft Sentinel Connector 

Microsoft Sentinel Connector offers us the trigger that can be used in our playbook while also providing us with actions to perform a variety of tasks like obtaining information of a specific incident, getting information about the entities associated with an alert, updating an incident, etc. Currently, it contains one trigger known as when a response to a Microsoft Sentinel alert is triggered i.e. the trigger will be fired whenever an alert is triggered. But, if you want an incident information, you have to use one of the actions to obtain the details. 

All the current actions for the Microsoft Sentinel connector are as follows:

Name	Description
Add comment to incident (V2)	Adds a comment to the selected incident.
Add labels to incident	Adds a label to the selected incident.
Alert – Get accounts	Returns a list of all the accounts associated with the alert. This is the account entity of the incident. Use it for each action to loop through all the individual accounts.
Alert – Get hosts	Returns a list of all the hosts associated with the alert. This is the host entity of the incident. Use it for each action to loop through all the individual hosts.
Alert – Get incident	Returns the incident associated with the selected alert.
Alert – Get Ips	Returns a list of all the IP addresses associated with the alert. This is the IP entity of the incident. Use it for each action to loop through all the individual IP addresses.
Change incident description (V2)	Changes the description of the selected incident.
Change incident severity	Changes the severity of the selected incident.
Change incident status	Changes the status of the selected incident.
Change incident title (V2)	Changes the title of the selected incident.
Remove labels from incident	Removes the labels from the selected incident.

  

To read part 2, please click here

To read part 3, please click here

To read part 4, please click here