История

Lior Tamir 41b497012a Last update time equal to pp start time All templates that appear from day 1 will be affected. Next templates will be uploaded with new times of upload		2021-07-15 18:37:10 +03:00
..
alert-trigger	Last update time equal to pp start time	2021-07-15 18:37:10 +03:00
incident-trigger	Last update time equal to pp start time	2021-07-15 18:37:10 +03:00
readme.md	Remove duplicate images	2021-06-29 09:40:07 +03:00

readme.md

Prompt-User

author: Nicholas DiCola

This playbook will ask the user if they completed the action from the Incident in Azure Sentinel. If so, it will close the incident and add a comment. If not, it will post a message to teams for the SOC to investigate and add a comment to the incident.

Quick Deployment

Deploy with incident trigger (recommended)

After deployment, attach this playbook to an automation rule so it runs when the incident is created.

Learn more about automation rules

Deploy with alert trigger

After deployment, you can run this playbook manually on an alert or attach it to an analytics rule so it will rune when an alert is created.

Deploy to Azure Gov

Prerequisites

This blog shows some simple methods to get the Team Id. You will need the Team Id and Channel Id.

Screenshots

Incident Trigger

Alert Trigger