You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- Before you create your playbook, we recommend that you read [Azure Logic Apps for Microsoft Sentinel playbooks](../automation/logic-apps-playbooks.md).
@@ -112,15 +112,15 @@ Follow these steps to create your playbook:
112
112
113
113
1. For **Subscription** and **Resource group**, select the values you want from their respective lists.
114
114
115
-
The **Region** value is set to the same region as the associated Log Analyics workspace.
115
+
The **Region** value is set to the same region as the associated Log Analytics workspace.
116
116
117
117
1. For **Playbook name**, enter a name for your playbook.
118
118
119
119
1. To monitor this playbook's activity for diagnostic purposes, select **Enable diagnostics logs in Log Analytics**, and then select a **Log Analytics workspace** unless you already selected a workspace.
120
120
121
121
1. Select **Next : Connections >**.
122
122
123
-
1. On the **Connections** tab, we recommend leaving the default values, which configures a logic app to connect to Microsoft Sentinel with a managed identity.
123
+
1. On the **Connections** tab, we recommend leaving the default values, which configure a logic app to connect to Microsoft Sentinel with a managed identity.
124
124
125
125
For more information, see [Authenticate playbooks to Microsoft Sentinel](authenticate-playbooks-to-sentinel.md).
126
126
@@ -162,7 +162,7 @@ Follow these steps to create your Standard logic app:
162
162
163
163
1. For **Pricing plan**, select the compute resources and their pricing for your logic app.
164
164
165
-
1. Under **Zone redunancy**, you can enable this capability if you selected an Azure region that supports availability zone redundancy.
165
+
1. Under **Zone redundancy**, you can enable this capability if you selected an Azure region that supports availability zone redundancy.
166
166
167
167
For this example, leave the option disabled. For more information, see [Protect logic apps from region failures with zone redundancy and availability zones](/azure/logic-apps/set-up-zone-redundancy-availability-zones).
168
168
@@ -188,7 +188,7 @@ Follow these steps to create your Standard logic app:
188
188
189
189
1. Under **Application Insights**, set **Enable Application Insights** to **No**.
190
190
191
-
This setting disables or enables performance monitoring with Application Insights in Azure Monitor. However, for Microsoft Sentintel, this capability isn't required and costs extra.
191
+
This setting disables or enables performance monitoring with Application Insights in Azure Monitor. However, for Microsoft Sentinel, this capability isn't required and costs extra.
192
192
193
193
1. To apply tags to this logic app for resource categorization and billing purposes, select **Next : Tags >**. Otherwise, select **Review + create**.
194
194
@@ -255,7 +255,7 @@ Follow these steps to create your Standard logic app:
255
255
256
256
1. Based on your selected authentication option, provide the necessary parameter values for the corresponding option.
257
257
258
-
For more information about these these parameters, see [Microsoft Sentinel connector reference](/connectors/azuresentinel/).
258
+
For more information about these parameters, see [Microsoft Sentinel connector reference](/connectors/azuresentinel/).
259
259
260
260
1. When you finish, select **Create new**.
261
261
@@ -308,15 +308,15 @@ To prevent this failure, we recommend that you create a condition that checks fo
308
308
309
309
1. In the editor, enter **null**, and select **Add**.
310
310
311
-
When you finish, your condtion looks simlar to the following example:
311
+
When you finish, your condition looks similar to the following example:
312
312
313
313
:::image type="content" source="../media/create-playbooks/no-incident-id.png" alt-text="Screenshot shows extra condition to add before the Incident ARM ID field." lightbox="../media/create-playbooks/no-incident-id.png":::
314
314
315
315
### Dynamic content: Work with custom details
316
316
317
317
In the **Microsoft Sentinel incident** trigger, the **Alert custom details** output is an array of JSON objects where each represents a [custom detail from an alert](../surface-custom-details-in-alerts.md). Custom details are key-value pairs that let you surface information from events in the alert so they can be represented, tracked, and analyzed as part of the incident.
318
318
319
-
This field in the alert is customizable, so its schema depends on the type of event that's surfaced. To generate the schema that determines how to parse the custom details output, provide the data from an instance of this event:
319
+
This field in the alert is customizable, so its schema depends on the type of event that is surfaced. To generate the schema that determines how to parse the custom details output, provide the data from an instance of this event:
320
320
321
321
1. On the Microsoft Sentinel workspace menu, under **Configuration**, select **Analytics**.
322
322
@@ -365,17 +365,17 @@ To use custom fields for incident triggers, follow these steps for your workflow
When you finish, the **Schema** box now contains the generated schema based on the sample that you provided. The **Parse JSON** action creates custom fields that you cannow use as dynamic fields with **Array** type in your workflow's subsequent actions.
368
+
When you finish, the **Schema** box now contains the generated schema based on the sample that you provided. The **Parse JSON** action creates custom fields that you can now use as dynamic fields with **Array** type in your workflow's subsequent actions.
369
369
370
-
The following example shows an array and its items, both in the schema and in the dynamic content list for a subsquent action named **Compose**:
370
+
The following example shows an array and its items, both in the schema and in the dynamic content list for a subsequent action named **Compose**:
371
371
372
-
:::image type="content" source="../media/create-playbooks/custom-fields-ready-to-use.png" alt-text="Screenshot shows ready-to-use dynamic fields from the schema." lightbox="../media/create-playbooks/custom-fields-ready-to-use.png":::
372
+
:::image type="content" source="../media/create-playbooks/custom-fields-ready-to-use.png" alt-text="Screenshot shows ready to use dynamic fields from the schema." lightbox="../media/create-playbooks/custom-fields-ready-to-use.png":::
373
373
374
374
## Manage your playbooks
375
375
376
376
Select the **Automation > Active playbooks** tab to view all the playbooks you have access to, filtered by your subscription view.
377
377
378
-
After onboarding to the unified security operations platform, by default the **Active playbooks** tab shows a predefined filter with onboarded workspace's subscription. **In the Azure portal**, edit the subscriptions you're showing from the **Directory + subscription** menu in the global Azure page header.
378
+
After you onboard to the unified security operations platform, by default the **Active playbooks** tab shows a predefined filter with onboarded workspace's subscription. **In the Azure portal**, edit the subscriptions you're showing from the **Directory + subscription** menu in the global Azure page header.
379
379
380
380
While the **Active playbooks** tab displays all the active playbooks available across any selected subscriptions, by default a playbook can be used only within the subscription to which it belongs, unless you specifically grant Microsoft Sentinel permissions to the playbook's resource group.
0 commit comments