Creating a new playbook
You are going to want to create playbooks, so now is the time to learn how to do that.
On the Microsoft Sentinel Automation page (see Figure 11.1), click on the Add Playbook link in the header. This will open a new tab in your browser that will lead to the Logic App screen, as shown in the following screenshot:
Figure 12.14 – Adding a new playbook
Let's discuss the different fields:
- In the Logic App name field, enter a descriptive name. No blanks are allowed but you can use underscores. Make the name descriptive enough so that other users will know what the playbook intends to do.
- From the Subscription dropdown, select the appropriate subscription. This should be the same subscription as where your Log Analytics (and Microsoft Sentinel) workspace is located.
- In the Resource group field, select an existing resource group or create a new one. It does not matter whether your playbooks are in the same resource...
