Domain 3 of 4 · Chapter 4 of 5

Respond to Incidents in Microsoft Sentinel

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Microsoft Certified: Security Operations Analyst Associate premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Incidents, alerts, and entities: the response model
  • Grouping: why ten alerts become one incident
  • Automation rules: the orchestration layer
  • Playbooks and the three Logic Apps triggers
  • Running playbooks against on-premises resources
  • Exam-pattern recognition

Automation rule vs playbook vs runbook: what each is for

AspectAutomation rulePlaybook (Logic App)Azure Automation runbook
What it isSentinel-native orchestration objectLogic Apps workflow on the Microsoft Sentinel connectorPowerShell/Python script run by Azure Automation
What triggers itIncident created/updated, or alert createdIncident, alert, or entity trigger (the Sentinel connector)Called by a playbook, schedule, or webhook
Typical jobAssign owner, tag, change status, suppress, run a playbookPost to Teams, open a ticket, isolate device, disable user, enrichRun arbitrary automation, including on-premises via a Hybrid Runbook Worker
Acts onIncidents (and alerts) inside SentinelWhatever the connector reaches, cloud or external SaaS/APICloud or on-premises machines the worker can reach
Runs playbooks?Yes, this is the central, RBAC-controlled way to run themIt IS the playbookNo, a playbook calls it
On-premises reachNo, it delegates to a playbookVia on-premises data gateway connectorVia Hybrid Runbook Worker on the on-prem host

Decision tree

External action needed?call out of SentinelAutomation ruleroute, tag, assign, suppressNoWhat launches it?pick the playbook triggerYes, build a playbookIncident triggerrun by an automation ruleAlert triggeron the analytics ruleEntity triggeron demand, one entityTarget on-premises?server in the datacenterOn-premises data gatewayconnector-backed targetHybrid Runbook WorkerAzure Automation runbook, scriptsconnector existsarbitrary scriptCloud targetconnector calls it directlyNo
Cheat sheet

Cheat sheet

  • A Sentinel incident groups related alerts, so you work the incident, not the alerts
  • Closing a Sentinel incident requires a classification, and the verdict feeds tuning
  • Alert grouping is a per-rule setting that folds one rule's repeated alerts into one incident
  • Suppress noise with an auto-close automation rule, not by disabling the detection
  • An automation rule routes incidents; it is the governed way to run playbooks
  • Automation rule actions run in order, and rules run in the order you set
  • Running a playbook needs the Microsoft Sentinel Automation Contributor role on its resource group
  • A playbook is a Logic App that takes the actual external action
  • Pick the playbook trigger by the object it acts on: incident, alert, or entity
  • An automation rule can only run an incident-triggered playbook
  • Attach an alert-triggered playbook on the analytics rule, not through an automation rule
  • Run an entity-triggered playbook on demand to enrich or remediate one entity
  • Reach an on-premises server from a playbook with a gateway or a hybrid worker, never an inbound port
  • Use the on-premises data gateway when a Logic Apps connector covers the target
  • Use an Azure Automation runbook on a Hybrid Runbook Worker for arbitrary on-premises scripts
  • Most playbooks are Consumption Logic Apps; choose Standard when you need VNet integration
  • Prefer a managed identity for a playbook's connection over a stored user credential
  • Investigate entities and walk the graph before remediating
  • Set an expiration on a temporary suppression automation rule so it cleans itself up
  • The 'When alert is created' automation-rule trigger only runs a playbook, keyed on rule name
  • On-premises data gateway: member server, install locally first, cluster via recovery key

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. What is Microsoft Sentinel SIEM?
  2. Investigate Microsoft Sentinel incidents in depth in the Azure portal
  3. Create scheduled analytics rules in Microsoft Sentinel
  4. Automate threat response in Microsoft Sentinel with automation rules
  5. Automate Threat Response with Playbooks in Microsoft Sentinel
  6. Connect to On-Premises Data Sources
  7. Azure Automation Hybrid Runbook Worker Overview