Update readme.md
This commit is contained in:
Родитель
6ebbfa1179
Коммит
147be03b76
|
@ -6,15 +6,15 @@ Incident tasks are a useful way to convey critical steps that should be taken to
|
|||
## Quick Deployment
|
||||
**Deploy with incident trigger**
|
||||
|
||||
After deployment, attach this playbook to an **automation rule** so it runs when the incident is created.
|
||||
|
||||
[Learn more about automation rules](https://docs.microsoft.com/azure/sentinel/automate-incident-handling-with-automation-rules#creating-and-managing-automation-rules)
|
||||
|
||||
[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FReopen-Incdient-With-Incomplete-Tasks%2Fincident-trigger%2Fazuredeploy.json)
|
||||
[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FPlaybooks%2FReopen-Incdient-With-Incomplete-Tasks%2Fincident-trigger%2Fazuredeploy.json)
|
||||
|
||||
## Post Deployment
|
||||
After deploying the playbook, grant the managed identity of the Playbook 'Microsoft Sentinel Responder' on the Microsoft Sentinel resource group. Additionally, create an analytics rule to invoke the playbook on incident update under the condition that status of the incident was changed to closed
|
||||
|
||||
1. Grant the managed identity of the Playbook 'Microsoft Sentinel Responder' on the Microsoft Sentinel resource group.
|
||||
2. Create an automation rule to invoke the playbook on incident update under the condition that status of the incident was changed to closed
|
||||
|
||||
[Learn more about automation rules](https://docs.microsoft.com/azure/sentinel/automate-incident-handling-with-automation-rules#creating-and-managing-automation-rules)
|
||||
|
||||
## Screenshots
|
||||
**Incident Trigger**<br>
|
||||
|
|
Загрузка…
Ссылка в новой задаче