Skip to content

Commit 0bf4db5

Browse files
authored
Update automation.md
1 parent 9ae592b commit 0bf4db5

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

articles/sentinel/automation/automation.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,12 +62,12 @@ After onboarding your Microsoft Sentinel workspace to the unified security opera
6262
| **Microsoft incident creation rules** | Microsoft incident creation rules aren't supported in the unified security operations platform. <br><br>For more information, see [Microsoft Defender XDR incidents and Microsoft incident creation rules](../microsoft-365-defender-sentinel-integration.md#microsoft-defender-xdr-incidents-and-microsoft-incident-creation-rules). |
6363
| **Running automation rules from the Defender portal** | It might take up to 10 minutes from the time that an alert is triggered and an incident is created or updated in the Defender portal to when an automation rule is run. This time lag is because the incident is created in the Defender portal and then forwarded to Microsoft Sentinel for the automation rule. |
6464
| **Active playbooks tab** | After onboarding to the unified security operations platform, by default the **Active playbooks** tab shows a predefined filter with onboarded workspace's subscription. In the Azure portal, add data for other subscriptions using the subscription filter. <br><br>For more information, see [Create and customize Microsoft Sentinel playbooks from content templates](use-playbook-templates.md). |
65-
| **Running playbooks manually on demand** | The following procedures aren't currently supported in the unified security operations platform: <br><li>[Run a playbook manually on an alert](run-playbooks.md#run-a-playbook-manually-on-an-alert)<br><li>[Run a playbook manually on an entity (Preview)](run-playbooks.md#run-a-playbook-manually-on-an-entity-preview) |
65+
| **Running playbooks manually on demand** | The following procedures aren't currently supported in the unified security operations platform: <br><li>[Run a playbook manually on an alert](run-playbooks.md#run-a-playbook-manually-on-an-alert)<br><li>[Run a playbook manually on an entity (Preview)](run-playbooks.md#run-a-playbook-manually-on-an-entity) |
6666
| **Running playbooks on incidents requires Microsoft Sentinel sync** | If you try to run a playbook on an incident from the unified security operations platform and see the message *"Can't access data related to this action. Refresh the screen in a few minutes."* message, this means that the incident isn't yet synchronized to Microsoft Sentinel. <br><br>Refresh the incident page after the incident is synchronized to run the playbook successfully. |
6767

6868

6969
## Related content
7070

7171
- [Automate threat response in Microsoft Sentinel with automation rules](../automate-incident-handling-with-automation-rules.md)
7272
- [Automate threat response with playbooks in Microsoft Sentinel](automate-responses-with-playbooks.md)
73-
- [Create and use Microsoft Sentinel automation rules to manage response](../create-manage-use-automation-rules.md)
73+
- [Create and use Microsoft Sentinel automation rules to manage response](../create-manage-use-automation-rules.md)

0 commit comments

Comments
 (0)