What's changed: Created SC-200 Chapter 1 (Domain 1 first-half: Defender XDR notifications/alert tuning (suppression)/correlation; Defender for Endpoint (advanced features/custom data collection/ASR rules/device groups/permissions/automation levels); AIR (automated investigation and response)/Action center/automatic attack disruption; Sentinel automation rules (declarative triage)/playbooks (Logic Apps, SOAR)).
1.4Sentinel automation rules and playbooks
Understand creating/configuring Microsoft Sentinel automation rules and playbooks (Azure Logic Apps), and automating incident response via SOAR.
Microsoft Sentinel adds SOAR (orchestration and automated response) to its SIEM. Whereas Defender XDR automation is "within the product," Sentinel automation orchestrates "org-wide incident operations."
1.4.1Automation rules
Automation rules declaratively automate incident triage—based on conditions (severity, title, tactics, etc.) they assign owners, change severity, tag, change status, and run playbooks. They centralize common handling across multiple analytics rules for consistent operations.
1.4.2Playbooks (Logic Apps)
Playbooks are automated workflows on Azure Logic Apps that run a chain of responses integrated with external systems—Teams/email notifications, ticketing (ServiceNow, etc.), disabling users, blocking IPs. Trigger them from automation rules (recommended) or directly on alert/incident creation. Analysts design to "automate repetitive first-response and reduce mean time to respond (MTTR)."
Cues: "declaratively automate incident triage (assign/severity/tag/status)" = automation rules. "a chain of automated responses with external integration (notify/ticket/disable/block)" = playbooks (Logic Apps). Trigger playbooks from automation rules (recommended).
Watch the mix-ups: (1) Automation rules (declarative triage) vs playbooks (Logic Apps execution workflow). (2) Sentinel SOAR (org-wide) vs Defender XDR automation (in-product AIR) are different layers. (3) Design approvals/guards for high-impact automated actions (e.g., mass disable).
1.4.3Section summary
- Automation rules = declaratively automate incident triage (assign/severity/tag/status/run playbook)
- Playbooks = Logic Apps automated workflows for notify/ticket/disable/block with external integration (trigger from rules)
- Sentinel SOAR (org-wide) and Defender XDR AIR (in-product) are different layers
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. On a dangerous incident, you want to auto-run "disable user → open ticket → notify Teams" with external integration. Which is best?
Q2. You want incidents auto-assigned to owners, tagged, and status-changed by severity/title conditions. Which is best?
Q3. What is the recommended way to trigger a playbook?
Q4. Which correctly distinguishes automation rules from playbooks?
Q5. Which correctly relates Sentinel SOAR and Defender XDR AIR?