Automated false-positive incident closure with a watchlist

Before we begin, you will need the following:

• You need to have access to Microsoft Sentinel with appropriate permissions (Microsoft Sentinel Contributor, Logic App Contributor, and permission to assign RBAC controls – Owner or User Access Administrator)

Creating a playbook

In this example, we will auto-close an incident automatically when the incident is created and when the IP address is an approved internal IP in a watchlist.

Let’s use the same strategy we used with our hands-on example in the previous chapter. First, we will list what we want to do and then do it step by step:

1. We need a watchlist that contains an IP address. We have one called MaliciousIP, created in Exercise 1 in the previous chapter. You should create a new watchlist called AllowedIP and use the same IP.
2. We will need a detection rule with an IP address. We created one in Exercise 1 in the previous chapter...