Configuring playbooks in Microsoft Sentinel
In Microsoft Sentinel, playbooks are collections of responses and actions that can be run like a routine. Playbooks automate and orchestrate threat responses and can be integrated with other systems, both internal and external. They can be configured to run manually or automatically in response to specific alerts or incidents. An example of an automated trigger for a playbook is an automation rule.
Automation rules enable users to centrally manage incident automation. This includes the ability to assign playbooks to incidents and automate responses for multiple analytics rules at once. Additionally, you can automatically tag, assign, or close incidents without requiring a playbook. You can also control the order of the actions executed.
Playbooks are based on Azure Logic Apps. Microsoft Sentinel can leverage the following logic app types:
