Creating a simple Azure Sentinel playbook

This example will take you step by step through the process of creating a new Azure Sentinel playbook. The scenario we are solving is notifying our security analysts using Microsoft Teams that a new, high-severity incident was created.

The first step is to create a new playbook that Azure Sentinel can use. Remember that for Azure Sentinel to be able to use a playbook, it must use the Azure Sentinel connector:

1. Go to the Azure Sentinel playbook screen and click the Add Playbook button in the header. Follow the Creating a new playbook section to add a new playbook. For this playbook, I am calling it BookDemo. Select the appropriate resource group and location. For this example, you do not need to store information in Log Analytics.
2. Once your playbook has been created, click on the Blank Logic App button to create a new logic app that has nothing in it.
3. In the Logic Apps Designer page, find and select the Azure Sentinel connector...