Forum Discussion

ColonelHawx1008's avatar
ColonelHawx1008
Copper Contributor
Aug 24, 2022

Sentinel Playbook | Condition on MDE (Defender for Endpoint) Device Risk

Any suggestions or if it possible to add a Playbook condition that will trigger based on the device/entity risk classified on Defender for Endpoint (security.microsoft.com) (Devices Inventory Blade) which displays device risks.

 

Thanks...

siem
  • GBushey's avatar
    GBushey
    Icon for Microsoft rankMicrosoft
    Aug 31, 2022
    A Microsoft Sentinel playbook can only trigger based on Microsoft Sentinel incidents. You would have to ask in the Microsoft Defender for Endpoint group if there is a way to accomplish what you want inside of MDE

Resources