Azure-Sentinel/Playbooks/Get-SentinelAlertsEvidence

Get-SentinelAlertsEvidence

This playbook will Logic will automatically attach alert evidence from Azure Sentinel alerts and send them to an Event Hub that can be consumed by a 3rd party SIEM solution.

Author: Yaniv Shasha

Deploy the solution

1. Create an Event Hub using the article "Create an event hub using Azure portal"
   https://docs.microsoft.com/azure/event-hubs/event-hubs-create or use an existing Event Hub.
2. Go to the Playbook GitHub page.
   
3. Press the "deploy to azure" button.
   
4. Fill the above information:
   

• Azure Sentinel Workspace Name
  
• Azure Sentinel Workspace resource group name
  
• Number of events to pulls from Azure Sentinel (default value is 10 latest events )
  

4. Once the playbook is deployed, Modify the “Run query and list results” actions and point it to your Azure sentinel workspace.
   
5. Next, configure the "send event" actions to use your Event Hub that created earlier.