Sentinel Playbooks

---
name: sentinel-playbooks
description: "Expert agent for Microsoft Sentinel Playbooks (Azure Logic Apps). Provides deep expertise in automation rules, Logic Apps designer, incident/entity triggers, 200+ connectors, managed identity authentication, ARM templates, and cost-effective automation patterns for Sentinel incidents. WHEN: \"Sentinel playbook\", \"Logic Apps security\", \"automation rule\", \"Sentinel automation\", \"incident trigger\", \"entity trigger\", \"Sentinel SOAR\", \"Logic App connector\"."
license: MIT
---

# Microsoft Sentinel Playbooks

This skill covers Microsoft Sentinel Playbooks, the SOAR capability built on Azure Logic Apps. It has deep knowledge of:

- Automation rules (lightweight triage automation, no Logic Apps required)
- Logic Apps-based playbooks (full orchestration workflows)
- Incident triggers, alert triggers, and entity triggers
- 200+ Logic Apps connectors for security orchestration
- Managed identity authentication for Azure resources
- ARM/Bicep templates for playbook-as-code deployment
- Microsoft Defender XDR integration (unified automation)
- Cost optimization for Logic Apps execution
- Microsoft Copilot for Security integration

## How to Approach Tasks

1. **Classify** the request:
   - **Simple automation** -- Automation rules (no code, no Logic Apps)
   - **Playbook development** -- Logic Apps designer, connector configuration
   - **Architecture** -- Trigger types, authentication, deployment patterns
   - **Integration** -- Connecting to external services, custom connectors
   - **Cost optimization** -- Execution cost management, consumption vs standard plan

2. **Determine trigger type** -- Incident trigger (most common), alert trigger, or entity trigger

3. **Check authentication** -- Managed identity (preferred) vs. connection-based authentication

4. **Recommend** actionable guidance with Logic Apps JSON definitions and Azure portal steps

## Core Expertise

### Automation Rules vs. Playbooks

Sentinel offers two levels of automation:

**Automation Rules (lightweight, no Logic Apps):**
- Run automatically when incidents are created or updated
- Actions: change status, change severity, assign owner, add tags, run playbook
- No custom logic or external API calls
- No cost beyond Sentinel (no Logic Apps execution fees)
- Use for: auto-assign, auto-tag, auto-close known patterns, triage routing

**Playbooks (Logic Apps -- full orchestration):**
- Triggered by automation rules or manually
- Full Logic Apps capability: API calls, conditions, loops, parallel execution
- 200+ connectors for external systems
- Per-execution cost (Logic Apps pricing)
- Use for: enrichment, containment, notification, ticketing, complex workflows

### Automation Rule Examples

```json
// Auto-assign phishing incidents to the phishing team
{
  "displayName": "Auto-assign phishing incidents",
  "order": 1,
  "triggeringLogic": {
    "isEnabled": true,
    "triggersOn": "Incidents",
    "triggersWhen": "Created",
    "conditions": [
      {
        "conditionType": "Property",
        "conditionProperties": {
          "propertyName": "IncidentTitle",
          "operator": "Contains",
          "propertyValues": ["phishing", "Phishing"]
        }
      }
    ]
  },
  "actions": [
    {
      "actionType": "ModifyProperties",
      "actionConfiguration": {
        "owner": {
          "objectId": "<phishing-team-group-id>"
        },
        "severity": "High"
      }
    },
    {
      "actionType": "RunPlaybook",
      "actionConfiguration": {
        "logicAppResourceId": "/subscriptions/.../playbook-phishing-triage"
      }
    }
  ]
}
```

### Playbook Trigger Types

| Trigger | Fires When | Available Data | Use Case |
|---|---|---|---|
| **Incident trigger** | Incident created or updated | Full incident with alerts, entities, metadata | Most common -- triage, enrichment, response |
| **Alert trigger** | Individual alert created | Single alert with entities | Alert-level processing (before incident grouping) |
| **Entity trigger** | Manually from entity page | Single entity (IP, user, host, etc.) | On-demand investigation of specific entities |

### Playbook Architecture

```json
// Logic Apps JSON definition: IP enrichment playbook
{
  "definition": {
    "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
    "triggers": {
      "Microsoft_Sentinel_incident": {
        "type": "ApiConnectionWebhook",
        "inputs": {
          "body": {
            "callback_url": "@{listCallbackUrl()}"
          },
          "host": {
            "connection": {
              "name": "@parameters('$connections')['azuresentinel']['connectionId']"
            }
          },
          "path": "/incident-creation"
        }
      }
    },
    "actions": {
      "Entities_-_Get_IPs": {
        "type": "ApiConnection",
        "inputs": {
          "body": "@triggerBody()?['object']?['properties']?['relatedEntities']",
          "host": {
            "connection": {
              "name": "@parameters('$connections')['azuresentinel']['connectionId']"
            }
          },
          "method": "post",
          "path": "/entities/ip"
        }
      },
      "For_each_IP": {
        "type": "Foreach",
        "foreach": "@body('Entities_-_Get_IPs')?['IPs']",
        "actions": {
          "VirusTotal_-_Get_IP_report": {
            "type": "ApiConnection",
            "inputs": {
              "host": {
                "connection": {
                  "name": "@parameters('$connections')['virustotal']['connectionId']"
                }
              },
              "method": "get",
              "path": "/api/v3/ip_addresses/@{items('For_each_IP')?['Address']}"
            }
          },
          "Add_comment_to_incident": {
            "type": "ApiConnection",
            "inputs": {
              "body": {
                "incidentArmId": "@triggerBody()?['object']?['id']",
                "message": "IP @{items('For_each_IP')?['Address']} VT score: @{body('VirusTotal_-_Get_IP_report')?['data']?['attributes']?['last_analysis_stats']?['malicious']}"
              },
              "host": {
                "connection": {
                  "name": "@parameters('$connections')['azuresentinel']['connectionId']"
                }
              },
              "method": "post",
              "path": "/Incidents/Comment"
            }
          }
        }
      }
    }
  }
}
```

### Key Connectors for Security

| Connector | Use Case | Authentication |
|---|---|---|
| **Microsoft Sentinel** | Incident management, entity extraction | Managed identity |
| **Microsoft Defender XDR** | Advanced hunting, incident sync | Managed identity |
| **Azure AD / Entra ID** | User disable, revoke sessions | Managed identity |
| **Microsoft Teams** | Alert notifications, approval requests | Connection |
| **ServiceNow** | Ticket creation, ITSM integration | Connection (basic/OAuth) |
| **VirusTotal** | IOC reputation lookup | API key |
| **AbuseIPDB** | IP reputation | API key |
| **HTTP** | Any REST API (custom integrations) | Various |
| **Azure Key Vault** | Retrieve secrets for API calls | Managed identity |

### Authentication Best Practices

**Managed identity (preferred for Azure resources):**
- System-assigned: tied to the Logic App lifecycle
- User-assigned: shared across multiple Logic Apps
- No credentials to manage
- Assign RBAC roles (e.g., Microsoft Sentinel Responder)

**Connection-based (for external services):**
- OAuth 2.0, API key, or basic auth
- Stored as API connections in the resource group
- Must be authorized per Logic App
- Consider using Key Vault references for sensitive credentials

### Deployment as Code

Use ARM templates or Bicep for reproducible deployments:

```bicep
// Bicep template for a Sentinel playbook
resource playbook 'Microsoft.Logic/workflows@2019-05-01' = {
  name: 'playbook-ip-enrichment'
  location: resourceGroup().location
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    definition: {
      '$schema': 'https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#'
      triggers: { /* ... */ }
      actions: { /* ... */ }
    }
    parameters: {
      '$connections': {
        value: { /* connection references */ }
      }
    }
  }
}

// Assign Sentinel Responder role
resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(playbook.id, sentinelResponderRoleId)
  properties: {
    roleDefinitionId: sentinelResponderRoleId
    principalId: playbook.identity.principalId
    principalType: 'ServicePrincipal'
  }
}
```

### Cost Optimization

Logic Apps pricing for playbooks:

| Plan | Cost Model | Best For |
|---|---|---|
| **Consumption** | Per action execution (~$0.000025/action) | Low-frequency playbooks |
| **Standard** | Monthly hosting + per-execution | High-frequency, complex playbooks |

**Cost reduction strategies:**
- Use automation rules for simple tasks (no Logic Apps cost)
- Use conditions early in playbooks to avoid unnecessary actions
- Batch API calls where possible (reduce action count)
- Use parallel branches for independent enrichment (reduces wall-clock time, same cost)
- Monitor execution costs via Azure Cost Management

## Common Pitfalls

1. **Connector authorization expiry** -- OAuth connections expire and need re-authorization. Use managed identity where possible. Monitor connector health.
2. **Logic Apps timeout** -- Default timeout is 30 seconds per action, 90 days per workflow. Long-running playbooks need webhook patterns.
3. **Rate limiting** -- External APIs (VirusTotal free tier: 4 req/min) require throttling. Add delays or use premium API tiers.
4. **Entity extraction failure** -- Entity extraction returns empty if analytics rules don't have entity mapping configured. Fix at the analytics rule level.
5. **Cost surprise** -- High-volume incident creation can trigger thousands of playbook executions. Use automation rule conditions to limit when playbooks run.
6. **Managed identity permissions** -- Forgetting to assign RBAC roles to the Logic App managed identity causes silent failures. Always assign Microsoft Sentinel Responder role at minimum.