2.6.2. Playbooks

💡 First Principle: Response often means touching systems outside the SIEM: a ticketing tool, a firewall, Entra ID, a chat channel, a threat intelligence lookup. Playbooks are Azure Logic Apps workflows that string those calls together with hundreds of prebuilt connectors, so a SOC can encode a multi-step response once and run it the same way every time.

A playbook starts with a Microsoft Sentinel trigger: the incident trigger (the usual choice, since it carries the incident with all its alerts and entities), the alert trigger, or the entity trigger (run from a specific account, host, IP, or URL during an investigation or hunt). From there, steps call connectors: look up an IP's reputation, create a ServiceNow ticket, post an adaptive card to Teams asking an analyst to approve a block, disable a user in Entra ID, add a comment back to the incident.

Common use cases group into four families: enrichment (collect data and attach it to the incident), bidirectional sync (keep incidents and tickets in step), orchestration (notify and coordinate people), and response (contain threats automatically or at an analyst's click).

Each connector step authenticates with its own identity, independent of whoever triggered the playbook. Microsoft recommends a managed identity for the Logic App where the connector supports it, granted only the permissions the playbook needs (for example, the Sentinel Responder role so it can update incidents, or an Entra role that allows disabling users). The alternatives are a service principal or a user-based connection, which breaks when that user changes password or leaves.

Playbooks run two ways: automatically from an automation rule, or manually by an analyst on an incident, alert, or entity. Permissions differ by job: Logic App Contributor to create and edit, Microsoft Sentinel Playbook Operator to run manually, and Microsoft Sentinel Automation Contributor for the Sentinel service account so automation rules can run them. Playbooks can be built as Consumption or Standard Logic Apps, and you can start from playbook templates in the Automation page's templates tab, Content hub solutions, or the Azure Sentinel GitHub repository; templates are meant to be customized, then tested by running them manually before you attach them to automation rules.

⚠️ Exam Trap: "The playbook runs but fails at the step that disables the user in Entra ID" is a permissions problem with the playbook's identity (its managed identity or connection lacks the right Entra role), not the analyst's role and not the Sentinel service account's permission, which governs only whether automation rules can launch it.

Reflection Question: Why does Microsoft recommend running playbooks under a managed identity instead of an analyst's user connection? Name two failure modes the user connection introduces.