This article assumes knowledge of how to create Microsoft Sentinel Analytic Rules, Automation Rules, and playbooks.
Create the playbook
You will want to create the playbook first, since one w...
Updated Jun 12, 2024
Version 1.0
Blog Post
Thanks for the runthrough! 🙂 always usefull.
I have to add, for me who is learning to create some basic playbooks - it would be superhelpfull if it was possible to chose some modules (like the "microsoft incident" and be able to trigger it from the builder (ie: press "run/play-button") just to see response for that exact step). In some cases i could then copy the JSON response and "generate template" through the gui. 🙂
Also setting variables are still a mystery to me, im always a little confused on where to set them in my loop so i end up with 5-10 variables before doing anything.