WPNinjas HeaderWPNinjas Header

Tag: Playbooks

Security
Christoph Düggeli

Sentinel Automation use case – custom Alerting with LogicApps

Intro I recently stumbled over a LogicApp (Microsoft Sentinel Playbook) I’ve created a long time ago where I needed to fix some stuff. The use case of the LogicApp is to handle the phone alerting process for customers with specific alerting requirements (no 24/7, only dedicated times during the day).

Read More »
Security
Christoph Düggeli

Sentinel Incident Automation – Playbook dependencies

Intro In this blog post I follow up on my previous blog post. There we addressed the challenge to to handle the (potentially massive) delay in entity mappings for security incidents.  Here’s the link in case you missed the blog post: Sentinel Incident Automation – handle entity mapping delay in

Read More »
Security
Christoph Düggeli

Sentinel Incident Automation – handle entity mapping delay​ in Playbooks

Intro Automation is a key element to improve SOC efficiency. Many different use cases exist where automation can be applied Tagging of Security incidents Severity level adoptions Auto-Closure Security incident information enrichment  …and many more Most of the automation is based on pre-defined conditions. To auto-close a security incident one

Read More »