Blog Post

Microsoft Sentinel Blog
4 MIN READ

What's New: SOC Process Framework is Now Live in Content Hub!

RinUre's avatar
RinUre
Icon for Microsoft rankMicrosoft
Aug 18, 2022
I am excited to announce that the SOC Process Framework has been updated and moved into Sentinel's Content Hub for installation across multiple workbooks, watchlists, and the amazing Get-SOCActions P...
Updated Aug 18, 2022
Version 1.0
deployment and configuration
siem
soar
solutions
RinUre's avatar
Icon for Microsoft rankMicrosoft
Joined January 09, 2020
View Profile
Microsoft Sentinel Blog

Microsoft Sentinel is an industry-leading SIEM & AI-first platform powering agentic defense across the entire security ecosystem.

SocInABox's avatar
SocInABox
Iron Contributor
Aug 19, 2022

RinUreA while back was create a similar playbook to yours, but I mapped the rules to ATT&CK's remediation values.

That would be a simple copy/paste into your watchlist once you map your rules to these:

 

https://attack.mitre.org/mitigations/enterprise/ 

 

Biggest challenge of course is someone needs to maintain the list.