Getting Started with Microsoft Sentinel - Respond To Threats
Automation rules helps in triaging the incidents in Microsoft Sentinel. They are used to automatically assign incidents to the right personnel, close noisy incidents or recognize false positives, etc. They are generally used in playbooks to respond to incidents or alerts.
Create a Playbook
- Select Automation from Microsoft Sentinel's navigation menu.
- Choose Create from the top menu.
- Under Create, four options are given for creating playbook-
- For Standard Playbook, choose Blank Playbook, and then follow the steps in the Logic Apps Standard tab.
- For Consumption Playbook, then, according to the required trigger, select either Playbook with incident trigger, Playbook with alert trigger, or Playbook with entity trigger. After that follow the steps in the Logic Apps Consumption tab.
- In the Basics tab:
- Select the Subscription, Resource group, and Region accordingly, from their respective lists. In this chosen region, the Logic App information will be stored.
- Under Playbook name, write a name for the playbook.
- To monitor this playbook's activity for diagnostic purposes, mark the Enable diagnostic logs in Log Analytics check box, and select a Log Analytics workspace from the drop-down list.
- However, if the playbooks need to access secured resources that are either inside or connected to an Azure virtual network, an Integration Service Environment (ISE) might be required. For that, mark the checkbox of Associate with integration service environment, and select the required ISE.
- Now, select Next : Connections >.
- In the Connections tab:
- Leave this section as it is and select Next : Review and create >.
- In the Review and Create tab:
- Review the configuration choices and choose Create and continue to designer.
4. The playbook will take a few minutes to be created and deployed and then the message "Your deployment is complete" will appear. Now, you will be taken to a new playbook's Logic App Designer, and the trigger chosen at the beginning will be automatically added as the first step to continue designing the workflow from there.
How to run a Playbook?
- When creating a new playbook, it might be required to test it before production.
- More control might be needed and human input to know when and whether the playbook runs.
A playbook can be run manually by opening an incident, alert, or entity and selecting and running the associated playbook displayed there.
Set an Automated Response
After setting an automated response, the rule will run a playbook besides creating an alert whenever an analytics rule is triggered. If this alert creates an incident, it will trigger an automation rule which may in turn run a playbook that will receive the incident as an input created by the alert.
Alert Creation Automated Response
- Edit an analytics rule that can generated the desired alert to define an automated response.
- In the Automated response tab and under Alert automation, choose the playbooks or playbook that this analytic rule will trigger after creating an alert.
Incident Creation Automated Response
- Edit the analytics rule that generates the required incident. Now, in the Automated response tab and under Incident automation, create an automation rule creating an exclusive automated response for this analytics rule only.
- In the Automation blade and from the Automation rules tab, create a new automation rule and specify the appropriate conditions and required actions. This automation rule ca be applied to any analytics rule that can fulfill those specific conditions.