История

Lior Tamir 18310804f0 Fix issues raised by automatic validations 1. Fix lastUpdateTime for the generic template 2. Fixed missing "PlaybookName" parameter for Block-OnPremADUser, 3. Fixed wrong workflow resource name for Run-AzureVMPacketCapture 4. Fixed hard-coded locations in GET-MDEProcessActivityWithin30Min, Get-Recipients-EmailMessageID-containtning-URL, Get-VTURLPositivesComment, Post-Tags-And-Comments-To-Your-Intsights-Account, SpurEnrichment 5. Fix suppport tier for Get-MDE-statistics, IdentityProtection-TeamsBotResponse, QuickStart-SentinelTriggers 6. SecureObject instead of secureobject in Resolve-MCAS 7. dnsresolution instead of DnsResoultion for entities in Restrict-MDEDomain 8. empty entities in SendAZCom		2022-02-27 12:00:11 +02:00
..
alert-trigger	Fix issues raised by automatic validations	2022-02-27 12:00:11 +02:00
incident-trigger	Fix issues raised by automatic validations	2022-02-27 12:00:11 +02:00
readme.md	Updating Deploy buttons and links part 1	2021-06-16 00:25:40 +00:00

Quick start - create a playbook from scratch with Sentinel triggers

Use this template to quickly create a new playbook which starts with an Azure Sentinel incident or Azure Sentinel alert.

Prerequisites

This playbook is configured to work with Managed Identity for the Azure Sentinel Logic Apps connector steps. After playbook is deployed, assign permissions for this playbook to Azure Sentinel workspace. Learn more

Deploy with incident trigger (recommended)

After deployment, attach this playbook to an automation rule so it runs when the incident is created.

Deploy with alert trigger

After deployment, you can run this playbook manually on an alert or attach it to an analytics rule so it will rune when an alert is created.