Merge pull request #102602 from shabaz-github/main

Updated waf-sentinel.md with new section of Automatically detect and respond to threats

Author: Jak-MS

articles/web-application-firewall/media/waf-sentinel/waf-detections.png

@@ -79,6 +79,17 @@ To enable log analytics for each resource, go to your individual Azure Front Doo
 1. Once finished configuring individual WAF resources, select the **Next steps** tab. Select one of the recommended workbooks. This workbook will use all log analytic data that was enabled previously. A working WAF workbook should now exist for your WAF resources.
 
    :::image type="content" source="media//waf-sentinel/waf-workbooks.png" alt-text="WAF workbooks" lightbox="media//waf-sentinel/waf-workbooks.png":::
+   
+## Automatically detect and respond to threats
+
+Using Sentinel ingested WAF logs, you can use Sentinel analytics rules to automatically detect security attacks, create security incident, and automatically respond to security incident using playbooks. Learn more [Use playbooks with automation rules in Microsoft Sentinel](../sentinel/tutorial-respond-threats-playbook.md?tabs=LAC).
+
+Azure WAF also comes in with built-in Sentinel detection rules templates for SQLi, XSS, and Log4J attacks. These templates can be found under the Analytics tab in the 'Rule Templates' section of Sentinel. You can use these templates or define your own templates based on the WAF logs. 
+
+:::image type="content" source="media//waf-sentinel/waf-detections.png" alt-text="WAF Detections" lightbox="media//waf-sentinel/waf-detections.png":::
+
+The automation section of these rules can help you automatically respond to the incident by running a playbook  An example of such a playbook to respond to attack can be found in network security GitHub repository [here](https://github.com/Azure/Azure-Network-Security/tree/master/Azure%20WAF/Playbook%20-%20WAF%20Sentinel%20Playbook%20Block%20IP%20-%20New). This playbook automatically creates WAF policy custom rules to block the source IPs of the attacker as detected by the WAF analytics detection rules.
+
 
 ## Next steps