This article assumes knowledge of how to create Microsoft Sentinel Analytic Rules, Automation Rules, and playbooks.
Create the playbook
You will want to create the playbook first, since one w...
Updated Jun 12, 2024
Version 1.0
Blog Post
Internetguy441 For your first comment, while that would be very useful, it would be rather difficult to do considering how different each incident can be from each other. That is why I suggested creating a dummy Analytic Rule that will create an incident that contains exactly what you need for testing. When you kick off the playbook from Sentinel, that initial step will have the parameters coming from the incident. You can look at the 'inputs' for that step to see the data being passed in.
Not sure I can help much with your statement regarding variables and loops. I know I have had many variables when doing testing before, both inside and outside of loops. The only suggestions I would make are to:
1) Make your variable names meaningful
2) Initialize all the variables close to each other (makes it easier to find each one if you need to)
3) Set the value of the variable as close to the step you are looking at as possible to ensure all the dynamic values are set correctly.
Keep in mind that the same variable can be used in each iteration of the loop and will contain the value for that specific iteration. So, if the loop loops 3 times, you do not need a separate variable for loop 1, loop 2, and loop 3.
Hope this helps.