Getting Started with Microsoft Sentinel - Respond To Threats

 

Overview

Microsoft Sentinel runs Playbooks in response to an entire incident, individual alert, or a specific entity. They are a collection of procedures used to automate and orchestrate a response. They can also be run automatically for specific alerts or when incidents are created or updated, by being attached to an automation rule. However, Playbooks can also run manually on-demand for specific incidents, alerts, or entities. 

Automation rules helps in triaging the incidents in Microsoft Sentinel. They are used to automatically assign incidents to the right personnel, close noisy incidents or recognize false positives, etc. They are generally used in playbooks to respond to incidents or alerts.

Create a Playbook

1. Select Automation from Microsoft Sentinel's navigation menu.
2. Choose Create from the top menu.
3. Under Create, four options are given for creating playbook-
1. For Standard Playbook, choose Blank Playbook, and then follow the steps in the Logic Apps Standard tab.
2. For Consumption Playbook, then, according to the required trigger, select either Playbook with incident trigger, Playbook with alert trigger, or Playbook with entity trigger. After that follow the steps in the Logic Apps Consumption tab.

• In the Basics tab:
• Select the Subscription, Resource group, and Region accordingly, from their respective lists. In this chosen region, the Logic App information will be stored.
• Under Playbook name, write a name for the playbook.
• To monitor this playbook's activity for diagnostic purposes, mark the Enable diagnostic logs in Log Analytics check box, and select a Log Analytics workspace from the drop-down list.
• However, if the playbooks need to access secured resources that are either inside or connected to an Azure virtual network, an Integration Service Environment (ISE) might be required. For that, mark the checkbox of Associate with integration service environment, and select the required ISE.
• Now, select Next : Connections >.

• In the Connections tab:
• Leave this section as it is and select Next : Review and create >.

• In the Review and Create tab:
• Review the configuration choices and choose Create and continue to designer.

      4. The playbook will take a few minutes to be created and deployed and then the message "Your                  deployment is complete" will appear. Now, you will be taken to a new playbook's Logic App                  Designer, and the trigger chosen at the beginning will be automatically added as the first step  to             continue designing the workflow from there.

How to run a Playbook?

Although the playbooks are ideally made to run automatically, there are circumstances when they are required to be run manually. For example:

• When creating a new playbook, it might be required to test it before production.
• More control might be needed and human input to know when and whether the playbook runs.

A playbook can be run manually by opening an incident, alert, or entity and selecting and running the associated playbook displayed there. 

Set an Automated Response

If routine responses for certain recurring incidents and alerts are automated, then, it will reduce the workload for the security operations teams to a greater extent. This also helps them in focusing more on unique incidents and alerts, analyzing patterns, threat hunting, etc.

After setting an automated response, the rule will run a playbook besides creating an alert whenever an analytics rule is triggered. If this alert creates an incident, it will trigger an automation rule which may in turn run a playbook that will receive the incident as an input created by the alert. 

Alert Creation Automated Response

If the playbooks are triggered by an alert creation and receives them as an input, then, they must be attached to an analytics rule:

1. Edit an analytics rule that can generated the desired alert to define an automated response.
2. In the Automated response tab and under Alert automation, choose the playbooks or playbook that this analytic rule will trigger after creating an alert.

Incident Creation Automated Response

If the playbooks are triggered by an incident creation and receives them as an input, then, they must create an automation rule and define a Run playbook action in it. There are two ways to do it:

1. Edit the analytics rule that generates the required incident. Now, in the Automated response tab and under Incident automation, create an automation rule creating an exclusive automated response for this analytics rule only.
2. In the Automation blade and from the Automation rules tab, create a new automation rule and specify the appropriate conditions and required actions. This automation rule ca be applied to any analytics rule that can fulfill those specific conditions.