Creating a new playbook

You are going to want to create your own playbooks, so now is the time to investigate how to do that.

In the Azure Sentinel playbooks page (see Figure 11.1), click on the Add Playbook link in the header. This will open a new tab in your browser that will open the Logic App screen, as shown in the following screenshot:

Figure 11.10 – Adding a new playbook

Let's discuss the different fields:

• In the Logic App name field, enter a descriptive name. No blanks are allowed but you can use underscores. Make the name descriptive enough so that other users will know what the playbook is intended to do.
• In the Subscription dropdown, select the appropriate subscription. This should be the same subscription as where your Log Analytics (and Azure Sentinel) workspace is located.
• In the Resource group field, select an existing resource group or create a new one. It does not matter whether your playbooks are in the same...