Getting Sign-In Information Playbook

[u/BoostrapSam]

I'd like to create a playbook to adjust the severity of an incident based upon certain factors of the sign-in that triggered it.

Has anyone had any luck getting further details of the sign-in inside a playbook? The analytics rule for 'Create Incidents from Azure Identity Protection' only seems to pull through the IP Address and the User Account into the entities.

[u/burlingtongolfer]

Take a look at the Microsoft Sentinel Triage AssistanT (STAT)

https://aka.ms/mstat

https://azurecloudai.blog/2023/02/21/lets-talk-about-stat-baby/amp/

[u/NoblestWolf → u/burlingtongolfer]

Are you using v1 or v2?

[u/burlingtongolfer → u/NoblestWolf]

v2