To minimize administrative effort in responding to incidents and remediating security threats in Microsoft Sentinel, you should use the platform's built-in automation and orchestration capabilities - specifically Automation Rules and Playbooks.
* Microsoft Sentinel Automation Rules (Option C):
* Automation rules in Sentinel allow you to automate incident management tasks such as assigning owners, changing severity, tagging, or automatically running playbooks when an incident or alert is created.
* They help standardize responses across similar alerts, significantly reducing manual intervention.
* Microsoft documentation states:
"Automation rules simplify the management of playbook triggers and incident handling by allowing you to define actions that automatically occur when incidents are created or updated."
* Microsoft Sentinel Playbooks (Option D):
* Playbooks are Logic App-based workflows that automate responses to security alerts or incidents.
* They can perform remediation actions such as disabling compromised accounts, isolating infected devices, blocking IP addresses, or sending notifications to SOC teams.
* You can link playbooks directly to analytics rules or call them through automation rules for end- to-end automation.
Incorrect Options:
* A. Bookmarks are used for hunting investigations, not for automation or remediation.
* B. Azure Automation runbooks can be used for specific administrative scripts but require more manual setup and integration - not the most efficient choice for Sentinel's automated workflows.
* E. Azure Functions apps are custom code execution environments; while powerful, they are not the primary tool for Sentinel's automated response.