At least one Microsoft Sentinel automation rule executes a playbook for automated threat response

Overview

Playbooks are Azure Logic Apps workflows authored against the Microsoft Sentinel connector and the Microsoft Sentinel Incident / Entity / Alert triggers. They execute the orchestrated response actions a SOC needs at machine speed: disable a Microsoft Entra user account, revoke active sessions, block an IP at Defender for Endpoint or the perimeter firewall, isolate a device, post to Microsoft Teams, open a ServiceNow ticket, run a containment script. An automation rule wires the trigger condition (which incidents) to the response (which playbook), closing the SOAR loop. Without a playbook-executing automation rule, response remains entirely manual: a credentialed-account-takeover incident requires a human analyst to acknowledge, triage, locate the affected user, and manually disable in Microsoft Entra, during which time the threat actor continues collection, credential access, and lateral movement. Industry data places median manual containment time at hours; orchestrated containment is sub-minute. The check confirms at least one enabled automation rule has an action whose actionType is RunPlaybook and whose actionConfiguration.logicAppResourceId references a Logic App resource that exists.

Remediation

• Automate and run Microsoft Sentinel playbooks
• Create and manage Microsoft Sentinel playbooks
• Use playbooks with automation rules

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Medium
Impact on users	Low
Pillar	SecOps
Category	Security information and event management
Product	Azure
Feature	Microsoft Sentinel
Area	Logging and detection
Licence	Consumption-based: Microsoft Sentinel
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.