Explanation:
Box 1: Data connectors
Ad the Windows Forwarded Events data connector.
To add the Windows Forwarded Events data connector to Microsoft Sentinel, navigate to Configuration > Data connectors, select the Windows Security Events via AMA connector, open the connector page, and follow the instructions to create a Data Collection Rule (DCR) that targets the desired servers and event logs using the Azure Monitor Agent (AMA).
Box 2: Automation
Create a playbook that has an incident trigger.
To create a Microsoft Sentinel playbook with an incident trigger, navigate to the Automation page in the Defender or Azure portal, select Create > Playbook with incident trigger, and then follow the wizard to provide basic information, establish connections (using the default managed identity), review the settings, and create the playbook. After creation, the playbook opens in the Logic Apps designer, where you can define the automation workflow.

Reference:
https://learn.microsoft.com/en-us/azure/sentinel/automation/create-playbooks