Domain 3 of 4 · Chapter 4 of 5

Respond to Incidents in Microsoft Sentinel

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Microsoft Certified: Security Operations Analyst Associate premium course — no separate purchase.

Included in this chapter:

  • Incidents, alerts, and entities: the response model
  • Grouping: why ten alerts become one incident
  • Automation rules: the orchestration layer
  • Playbooks and the three Logic Apps triggers
  • Running playbooks against on-premises resources
  • Exam-pattern recognition

Automation rule vs playbook vs runbook: what each is for

AspectAutomation rulePlaybook (Logic App)Azure Automation runbook
What it isSentinel-native orchestration objectLogic Apps workflow on the Microsoft Sentinel connectorPowerShell/Python script run by Azure Automation
What triggers itIncident created/updated, or alert createdIncident, alert, or entity trigger (the Sentinel connector)Called by a playbook, schedule, or webhook
Typical jobAssign owner, tag, change status, suppress, run a playbookPost to Teams, open a ticket, isolate device, disable user, enrichRun arbitrary automation, including on-premises via a Hybrid Runbook Worker
Acts onIncidents (and alerts) inside SentinelWhatever the connector reaches, cloud or external SaaS/APICloud or on-premises machines the worker can reach
Runs playbooks?Yes, this is the central, RBAC-controlled way to run themIt IS the playbookNo, a playbook calls it
On-premises reachNo, it delegates to a playbookVia on-premises data gateway connectorVia Hybrid Runbook Worker on the on-prem host

Decision tree

External action needed?call out of SentinelAutomation ruleroute, tag, assign, suppressNoWhat launches it?pick the playbook triggerYes, build a playbookIncident triggerrun by an automation ruleAlert triggeron the analytics ruleEntity triggeron demand, one entityTarget on-premises?server in the datacenterOn-premises data gatewayconnector-backed targetHybrid Runbook WorkerAzure Automation runbook, scriptsconnector existsarbitrary scriptCloud targetconnector calls it directlyNo
Cheat sheet

Cheat sheet

  • A Sentinel incident groups related alerts, so you work the incident, not the alerts
  • Closing a Sentinel incident requires a classification, and the verdict feeds tuning
  • Alert grouping is a per-rule setting that folds one rule's repeated alerts into one incident
  • Suppress noise with an auto-close automation rule, not by disabling the detection
  • An automation rule routes incidents; it is the governed way to run playbooks
  • Automation rule actions run in order, and rules run in the order you set
  • Running a playbook needs the Microsoft Sentinel Automation Contributor role on its resource group
  • A playbook is a Logic App that takes the actual external action
  • Pick the playbook trigger by the object it acts on: incident, alert, or entity
  • An automation rule can only run an incident-triggered playbook
  • Attach an alert-triggered playbook on the analytics rule, not through an automation rule
  • Run an entity-triggered playbook on demand to enrich or remediate one entity
  • Reach an on-premises server from a playbook with a gateway or a hybrid worker, never an inbound port
  • Use the on-premises data gateway when a Logic Apps connector covers the target
  • Use an Azure Automation runbook on a Hybrid Runbook Worker for arbitrary on-premises scripts
  • Most playbooks are Consumption Logic Apps; choose Standard when you need VNet integration
  • Prefer a managed identity for a playbook's connection over a stored user credential
  • Investigate entities and walk the graph before remediating
  • Set an expiration on a temporary suppression automation rule so it cleans itself up
  • The 'When alert is created' automation-rule trigger only runs a playbook, keyed on rule name
  • On-premises data gateway: member server, install locally first, cluster via recovery key

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. https://learn.microsoft.com/en-us/azure/sentinel/overview
  2. https://learn.microsoft.com/en-us/azure/sentinel/investigate-incidents
  3. https://learn.microsoft.com/en-us/azure/sentinel/investigate-with-incident-overview
  4. https://learn.microsoft.com/en-us/azure/sentinel/detect-threats-custom
  5. https://learn.microsoft.com/en-us/azure/sentinel/automate-incident-handling-with-automation-rules
  6. https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks
  7. https://learn.microsoft.com/en-us/azure/logic-apps/logic-apps-gateway-connection
  8. https://learn.microsoft.com/en-us/azure/automation/automation-hybrid-runbook-worker