Forum Discussion
Sentinel Automation Requirements
Hi Team, Please help to checking feasibility for the following use case: Create an automation to email users when their failed logins exceed a specific threshold (using SecurityEvent log). Please...
Hi Bhavini,
the oversimplified answer would be:
- Build the analytics query (KQL) matching your requirements with regards to failed logins.
- Create an analytics rule in order to create an alert, based on your analytic.
- Create a playbook based on your analytic rule, which will incorporate adaptive cards for Teams.
- User will receive a Teams notification/card where she/he will have to confirm activity.
- Upon response, playbook will either create an incident, or close the alert.
If I have answered your question, please mark your post as Solved
If you like my response, please consider giving it a like
