Search icon CANCEL
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Conferences
Free Learning
Arrow right icon
Arrow up icon
GO TO TOP
Security Orchestration, Automation, and Response for Security Analysts

You're reading from   Security Orchestration, Automation, and Response for Security Analysts Learn the secrets of SOAR to improve MTTA and MTTR and strengthen your organization's security posture

Arrow left icon
Product type Paperback
Published in Jul 2023
Publisher Packt
ISBN-13 9781803242910
Length 338 pages
Edition 1st Edition
Arrow right icon
Author (1):
Arrow left icon
Benjamin Kovacevic Benjamin Kovacevic
Author Profile Icon Benjamin Kovacevic
Benjamin Kovacevic
Arrow right icon
View More author details
Toc

Table of Contents (14) Chapters Close

Preface 1. Part 1: Intro to SOAR and Its Elements
2. Chapter 1: The Current State of Cybersecurity and the Role of SOAR FREE CHAPTER 3. Chapter 2: A Deep Dive into Incident Management and Investigation 4. Chapter 3: A Deep Dive into Automation and Reporting 5. Part 2: SOAR Tools and Automation Hands-On Examples
6. Chapter 4: Quick Dig into SOAR Tools 7. Chapter 5: Introducing Microsoft Sentinel Automation 8. Chapter 6: Enriching Incidents Using Automation 9. Chapter 7: Managing Incidents with Automation 10. Chapter 8: Responding to Incidents Using Automation 11. Chapter 9: Mastering Microsoft Sentinel Automation: Tips and Tricks 12. Index 13. Other Books You May Enjoy

Exploring more playbook actions

Each action in the playbook has its own settings that we can work with. We have already mentioned options to rename an action, add a comment, or delete one in previous chapters, but there are a few more great features that you need to know about:

  • We have the option to configure a timeout for an action. We usually want this to be used with user input when we don’t want to wait hours or days for a user to respond. Logic Apps Standard and Logic Apps Consumption can be in a running state for 90 days by default. To change it, we need to click on the three dots in the playbook and select Settings.

Figure 9.14 – Action settings

In the settings, we need to change the value for Action Timeout. It accepts input in the ISO 8601 format. If we wanted that action to time out after one day, the input would be P1D. If we wanted it to time out in one hour, the input would be PT1H. An example of all the values needed...

lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at €18.99/month. Cancel anytime