Using Azure Sentinel playbooks

Azure Sentinel includes a feature called playbooks. These can be used to create automated responses where Sentinel detects security issues. For example, should one of the workbooks we configured in the previous section detect an issue, a playbook could be configured to respond to that, either manually or automatically.

Important note

Playbooks are based on Azure Logic apps, and therefore should you wish to use them, you will need to be aware of additional charges that you will incur.

Let's look at how to create a security playbook in Azure Sentinel. Here, we will connect a playbook to the Logic Apps designer and trigger an email alert when a SharePoint list is modified. This is achieved by completing the following steps:

1. From the Azure Sentinel portal, select Configuration | Playbooks:
   

   Figure 10.26 – Configuring a security playbook

2. Click on Add Playbook:
   

   Figure 10.27 – Adding a playbook

3. In this example, we will...