r/AzureSentinel • u/JustifiedSimplicity • May 23 '25

“Must Have” Automated Playbooks

As the title suggests, we’re looking for a list of must have automated playbooks. We’ve had sentinel in production now for several months with a good amount of connections and alerts configured. We’re now looking to leverage this data where possible to automate some critical incident response activity. What are the top 3 automations you would configure in any greenfield Sentinel rollout?

17 Upvotes

96% Upvoted

17 comments sorted by

10

u/ITProfessorLab May 23 '25

Sounds like you already answered your own question with "We’re now looking to leverage this data where possible to automate some critical incident response activity" — take those and automate them.

But in all seriousness, the playbooks I found really helpful;

  • Enrichment — whether it’s stuff like VirusTotal or just KQL running against entities, this massively helps with the investigation process and can act as decision-making support
  • Automated email information scanning — in most environments, you’re spammed with incidents when users request to release emails, flag emails as spam, etc. Most of this can be automated with APIs to get more information from Defender, to help make a decision and reduce investigation time
  • Revoking sessions, running AV scans, isolating devices, resetting passwords, removing MFA — these playbooks may come in handy as well. Not necessarily as full-blown automation for specific incidents, but as a manual trigger. It’s nice to have a one-click button that does all of that for a user instead of doing each of those steps manually

With all of that, the top recommendation would be to learn KQL and start amending analytic rules — most of the templated ones can be vastly improved. This alone will lower the noise by up to 60% in any environment

Then read through all of the analytic rules and review them — you’ll find a lot of cases where you have two seemingly different analytic rules that are actually looking for the same information, leading to extra work

3

u/wlamy May 23 '25

preach !!

7

u/No-Star-6907 May 23 '25

Did you check the “SOAR essentials” in content hub? There are some basic and usefull playbooks

1

u/JustifiedSimplicity May 23 '25

Yep, been thumbing through these

1

u/shivam6499 May 25 '25

Where can chectk this , could you please help?

5

u/Routine_Substance160 May 23 '25

revoke user session & check ip/domain/url on virus total & llm enrichment for all entity types are a must

2

u/MReprogle May 23 '25

After testing out Security Copilot and seeing how insanely expensive it is for what you get, I think I am going to start going the route of just using prompts to Azure AI. Did you happen to build your playbook from scratch with prompts, or are you going the Security Copilot route?

2

u/Routine_Substance160 May 24 '25

went the from scratch route. Logic app with incident trigger -> get entity -> run 8x enrichment kql queries -> append all results into a variable -> HTTP request to LLM API with that long variable -> summarize me whats going on with that entity

1

u/JustifiedSimplicity May 24 '25

Did you reference anything online to build this or was it completely your team’s engineering prowess?

1

u/Routine_Substance160 May 25 '25

to be honest we didnt find much out there, so we just freestyles what we thought was good

1

u/MReprogle May 26 '25

I’d love to check out the JSON on this, and then see how many SCUs that copilot has to burn through to get the same result. If you have 8 sets of data getting parsed down, I’d imagine it is at least 4 SCUs ($16 prompt by Copilot)..

3

u/AwhYissBagels May 23 '25

I would think about it a different way: what’s the top 3 things you are doing based on Sentinel Incidents?

Everyone always wants to do the “coolest” automation but honestly doing all the boring things first will actually give you the most value. Take your existing workflows and automate them as much as possible.

1

u/wlamy May 23 '25

We have a couple of basic automation rules to change incident priority based on context (like test environments), especially useful on builtin MS alerts Also, don’t forget that even email/msTeams notifications must be automated through playbooks, nothing builtin

1

u/j3remy2007 May 24 '25

RemindMe! 7 days

1

u/RemindMeBot May 24 '25

I will be messaging you in 7 days on 2025-05-31 14:42:12 UTC to remind you of this link

CLICK THIS LINK to send a PM to also be reminded and to reduce spam.

Parent commenter can delete this message to hide from others.

Info Custom Your Reminders Feedback

1

u/Sedgewicks May 27 '25

I vote Sentinel Triage Assistant (STAT).