The goal is to automatically execute the Azure Logic App ( app1 ), which is known as a Playbook in Microsoft Sentinel, in response to a newly created alert.
* The Playbook (Logic App): An Azure Logic App used for security response in Microsoft Sentinel is called a Playbook. It is a workflow that must start with a trigger, typically the Microsoft Sentinel incident or Microsoft Sentinel alert trigger.
* The Trigger Mechanism (Automation Rule): To run a playbook automatically when an alert or incident is created, you must use a Microsoft Sentinel Automation Rule .
* Required Flow: The Logic App ( app1 ) acts as the action to be performed, but it must be called by an automation component. The recommended and modern approach for linking automated actions (playbooks) to alerts and incidents in Microsoft Sentinel is via Automation Rules .
The sequence of operations is:
* The Azure AD Connector ingests data into the Microsoft Sentinel workspace.
* A corresponding Analytics Rule (Option C) detects a threat in that data and generates an Alert . This alert usually leads to the creation of an Incident .
* The Automation Rule (Option D) is configured to:
* Trigger: When an incident is created (or when an alert is created).
* Condition: Filter for the specific alert or incident (e.g., where the Analytic Rule Name is the one that detects the Azure AD threat).
* Action: Select the Run playbook action and specify app1 .
While an Analytics Rule (C) generates the initial alert, the Automation Rule (D) is the specific component that takes that alert/incident as input and performs the action of launching the Logic App (playbook) automatically. The ability to invoke playbooks directly from Analytics Rules (the " Alert automation (classic)
" method) is deprecated in favor of using Automation Rules, making the Automation Rule the correct and contemporary first step for this requirement.