You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/automation/automate-responses-with-playbooks.md
+22-22Lines changed: 22 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,10 +1,10 @@
1
1
---
2
-
title: Automate threat response with playbooks in Microsoft Sentinel | Microsoft Docs
3
-
description: This article explains automation in Microsoft Sentinel, and shows how to use playbooks to automate threat prevention and response.
2
+
title: Automate Threat Response with Playbooks in Microsoft Sentinel
3
+
description: Learn how to automate threat response in Microsoft Sentinel using playbooks to efficiently manage security alerts and incidents.
4
4
ms.topic: conceptual
5
5
author: batamig
6
6
ms.author: bagol
7
-
ms.date: 03/14/2024
7
+
ms.date: 05/27/2025
8
8
appliesto:
9
9
- Microsoft Sentinel in the Microsoft Defender portal
10
10
- Microsoft Sentinel in the Azure portal
@@ -15,33 +15,33 @@ ms.collection: usx-security
15
15
16
16
# Automate threat response with playbooks in Microsoft Sentinel
17
17
18
-
SOC analysts deal with numerous security alerts and incidents, and the sheer volume can overwhelm teams, leading to ignored alerts and uninvestigated incidents. Many alerts and incidents can be addressed by the same sets of predefined remediation actions, which can be automated to make the SOC more efficient and free up analysts for deeper investigations.
18
+
Security operations centers (SOCs) face a constant stream of security alerts and incidents. Managing these efficiently is critical to keeping your organization’s security strong. Microsoft Sentinel playbooks are automated workflows that help you respond to threats quickly and consistently. This article shows how to use playbooks in Microsoft Sentinel to automate threat response, cut manual effort, and let your team focus on deeper investigations.
19
19
20
-
Use Microsoft Sentinel playbooks to run preconfigured sets of remediation actions to help [automate and orchestrate your threat response](tutorial-respond-threats-playbook.md). Run playbooks automatically, in response to specific alerts and incidents that trigger a configured [automation rule](../automate-incident-handling-with-automation-rules.md), or manually and on-demand for a particular entity or alert.
20
+
Use Microsoft Sentinel playbooks to run preconfigured sets of remediation actions and [automate and orchestrate your threat response](tutorial-respond-threats-playbook.md). Run playbooks automatically in response to specific alerts and incidents that trigger a configured [automation rule](../automate-incident-handling-with-automation-rules.md), or run them manually for a particular entity or alert.
21
21
22
-
For example, if an account and machine are compromised, a playbook can automatically isolate the machine from the network and block the account by the time the SOC team is notified of the incident.
22
+
For example, if an account and machine are compromised, a playbook can automatically isolate the machine from the network and block the account before the SOC team gets notified of the incident.
23
23
24
24
> [!NOTE]
25
-
> Because playbooks make use of Azure Logic Apps, additional charges may apply. Visit the [Azure Logic Apps](https://azure.microsoft.com/pricing/details/logic-apps/) pricing page for more details.
25
+
> Because playbooks use Azure Logic Apps, additional charges can apply. Go to the [Azure Logic Apps](https://azure.microsoft.com/pricing/details/logic-apps/) pricing page for more details.
The following table lists high-level use cases where we recommend using Microsoft Sentinel playbooks to automate your threat response:
31
+
The following table lists common use cases where Microsoft Sentinel playbooks help automate threat response:
32
32
33
33
|Use case |Description |
34
34
|---------|---------|
35
-
|**Enrichment**| Collect data and attach it to an incident to help your team make smarter decisions. |
36
-
|**Bi-directional sync**| Sync Microsoft Sentinel incidents with other ticketing systems. For example, create an automation rule for all incident creations, and attach a playbook that opens a ticket in ServiceNow. |
37
-
|**Orchestration**| Use the SOC team's chat platform to better control the incidents queue. For example, send a message to your security operations channel in Microsoft Teams or Slack to make sure your security analysts are aware of the incident. |
38
-
|**Response**|Immediately respond to threats, with minimal human dependencies, such as when a compromised user or machine is indicated. Alternately, manually trigger a series of automated steps during an investigation or while hunting. |
35
+
|**Enrichment**| Collect data and attach it to an incident so your team can make better decisions. |
36
+
|**Bi-directional sync**| Sync Microsoft Sentinel incidents with other ticketing systems. For example, create an automation rule for all new incidents, and attach a playbook that opens a ticket in ServiceNow. |
37
+
|**Orchestration**| Use the SOC team's chat platform to manage the incident queue. For example, send a message to your security operations channel in Microsoft Teams or Slack so your security analysts know about the incident. |
38
+
|**Response**|Respond to threats right away with minimal human involvement, such as when a compromised user or machine is detected. Or, manually trigger automated steps during an investigation or while hunting. |
39
39
40
40
For more information, see [Recommended playbook use cases, templates, and examples](playbook-recommendations.md).
41
41
42
42
## Prerequisites
43
43
44
-
The following roles are required to use Azure Logic Apps to create and run playbooks in Microsoft Sentinel.
44
+
You need the following roles to use Azure Logic Apps to create and run playbooks in Microsoft Sentinel.
@@ -54,17 +54,17 @@ The following roles are required to use Azure Logic Apps to create and run playb
54
54
> [!IMPORTANT]
55
55
> Playbook templates are currently in PREVIEW. See the **[Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/)** for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
56
56
57
-
Playbook templates are prebuilt, tested, and ready-to-use workflows that aren't useable as playbooks themselves, but are ready for you to customize to meet your needs. We also recommend that you use playbook templates as a reference of best practices when developing playbooks from scratch, or as inspiration for new automation scenarios.
57
+
Playbook templates are prebuilt, tested, and ready to use workflows that you can't use as playbooks themselves, but you can customize them to meet your needs. Use playbook templates as a reference for best practices when you develop playbooks from scratch, or as inspiration for new automation scenarios.
58
58
59
-
Access playbook templates from the following sources:
59
+
Get playbook templates from these sources:
60
60
61
61
|Location |Description |
62
62
|---------|---------|
63
-
|**Microsoft Sentinel Automation page**| The **Playbook templates** tab lists all installed playbooks. Create one or more active playbooks using the same template. <br><br>When we publish a new version of a template, any active playbooks created from that template have an extra label added in the **Active playbooks** tab to indicate that an update is available. |
64
-
|**Microsoft Sentinel Content hub page**| Playbook templates are available as part of product solutions or standalone content installed from the **Content hub**. <br><br>For more information, see: <br> [About Microsoft Sentinel content and solutions](../sentinel-solutions.md) <br>[Discover and manage Microsoft Sentinel out-of-the-box content](../sentinel-solutions-deploy.md)|
65
-
|**GitHub**| The [Microsoft Sentinel GitHub repository](https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks)contains many other playbook templates. Select **Deploy to Azure** to deploy a template to your Azure subscription.|
63
+
|**Microsoft Sentinel Automation page**| The **Playbook templates** tab shows all installed playbooks. Create one or more active playbooks using the same template. <br><br>When a new version of a template is published, any active playbooks created from that template get an extra label in the **Active playbooks** tab to show that an update is available. |
64
+
|**Microsoft Sentinel Content hub page**| Playbook templates are part of product solutions or standalone content you install from the **Content hub**. <br><br>For more information, see: <br> [About Microsoft Sentinel content and solutions](../sentinel-solutions.md) <br>[Discover and manage Microsoft Sentinel out-of-the-box content](../sentinel-solutions-deploy.md)|
65
+
|**GitHub**| The [Microsoft Sentinel GitHub repository](https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks)has many other playbook templates. Select **Deploy to Azure** to deploy a template to your Azure subscription.|
66
66
67
-
Technically, a playbook template is an [Azure Resource Manager (ARM) template](/azure/azure-resource-manager/templates/), which consists of several resources: an Azure Logic Apps workflow and API connections for each connection involved.
67
+
A playbook template is an [Azure Resource Manager (ARM) template](/azure/azure-resource-manager/templates/) that includes several resources: an Azure Logic Apps workflow and API connections for each connection involved.
68
68
69
69
For more information, see:
70
70
@@ -74,15 +74,15 @@ For more information, see:
74
74
75
75
## Playbook creation and usage workflow
76
76
77
-
Use the following workflow to create and run Microsoft Sentinel playbooks:
77
+
Follow these steps to create and run Microsoft Sentinel playbooks:
78
78
79
-
1. Define your automation scenario. We recommend that you review [recommended playbooks use cases](playbook-recommendations.md#recommended-playbook-use-cases) and [playbook templates](playbook-recommendations.md#recommended-playbook-templates) to start.
79
+
1. Define your automation scenario. Review [recommended playbooks use cases](playbook-recommendations.md#recommended-playbook-use-cases) and [playbook templates](playbook-recommendations.md#recommended-playbook-templates) to get started.
80
80
81
81
1. If you're not using a template, create your playbook and build your logic app. For more information, see [Create and manage Microsoft Sentinel playbooks](create-playbooks.md).
82
82
83
83
Test your logic app by running it manually. For more information, see [Run a playbook manually, on demand](run-playbooks.md#run-a-playbook-manually-on-demand).
84
84
85
-
1.Configure your playbook to run automatically on a new alert or incident creation, or run it manually as needed for your processes. For more information, see [Respond to threats with Microsoft Sentinel playbooks](run-playbooks.md).
85
+
1.Set up your playbook to run automatically when a new alert or incident is created, or run it manually as needed for your process. For more information, see [Respond to threats with Microsoft Sentinel playbooks](run-playbooks.md).
0 commit comments