This commit is contained in:
Brian Delaney 2024-06-10 13:53:45 -04:00 коммит произвёл GitHub
Родитель 6ebbfa1179
Коммит 147be03b76
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: B5690EEEBB952194
1 изменённых файлов: 5 добавлений и 5 удалений

Просмотреть файл

@ -6,15 +6,15 @@ Incident tasks are a useful way to convey critical steps that should be taken to
## Quick Deployment
**Deploy with incident trigger**
After deployment, attach this playbook to an **automation rule** so it runs when the incident is created.
[Learn more about automation rules](https://docs.microsoft.com/azure/sentinel/automate-incident-handling-with-automation-rules#creating-and-managing-automation-rules)
[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FReopen-Incdient-With-Incomplete-Tasks%2Fincident-trigger%2Fazuredeploy.json)
[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FReopen-Incdient-With-Incomplete-Tasks%2Fincident-trigger%2Fazuredeploy.json)
## Post Deployment
After deploying the playbook, grant the managed identity of the Playbook 'Microsoft Sentinel Responder' on the Microsoft Sentinel resource group. Additionally, create an analytics rule to invoke the playbook on incident update under the condition that status of the incident was changed to closed
1. Grant the managed identity of the Playbook 'Microsoft Sentinel Responder' on the Microsoft Sentinel resource group.
2. Create an automation rule to invoke the playbook on incident update under the condition that status of the incident was changed to closed
[Learn more about automation rules](https://docs.microsoft.com/azure/sentinel/automate-incident-handling-with-automation-rules#creating-and-managing-automation-rules)
## Screenshots
**Incident Trigger**<br>