In Microsoft Sentinel , an automated threat response is achieved by using playbooks , which are automation workflows built on top of Azure Logic Apps . Microsoft's Sentinel documentation explains:
"Playbooks help automate and orchestrate your response to security threats detected in your environment. A playbook can take actions such as sending notifications, blocking IP addresses, disabling user accounts, or integrating with third-party systems." Playbooks are triggered by alerts or incidents generated within Sentinel. They allow security operations teams to standardize and automate repetitive response tasks, reducing response time and minimizing manual effort.
For example, when Sentinel detects a suspicious login attempt, a playbook can automatically isolate the affected device in Defender for Endpoint or block the user account in Microsoft Entra ID.
Here's why the other options are incorrect:
* Data connector (A) is used to import logs and telemetry data into Sentinel but does not perform any response action.
* Workbook (C) provides visual reporting and dashboards for analysis, not automation.
* Microsoft incident creation rule (D) helps group alerts into incidents but cannot perform automated remediation or response actions.
Therefore, the correct and verified configuration for automated threat response in Microsoft Sentinel is to use a playbook , which integrates detection and automated remediation within the SecOps workflow.