История

SecurityJedi f9af989df3 Update azuredeploy.json		2021-09-09 16:10:01 -07:00
..
alert-trigger	Update azuredeploy.json	2021-09-09 16:09:36 -07:00
incident-trigger	Update azuredeploy.json	2021-09-09 16:10:01 -07:00
readme.md	Updating Deploy buttons and links part 1	2021-06-16 00:25:40 +00:00

readme.md

Block-AADUser

author: Nicholas DiCola

This playbook will disable the user in Azure Active Directory and add a comment to the incident. There is an option for incident and alert trigger below.

Quick Deployment

Deploy with incident trigger (recommended)

After deployment, attach this playbook to an automation rule so it runs when the incident is created.

Learn more about automation rules

Deploy with alert trigger

After deployment, you can run this playbook manually on an alert or attach it to an analytics rule so it will rune when an alert is created.

Prerequisites

None

Screenshots

Incident Trigger
Alert Trigger