# At least one Microsoft Sentinel automation rule executes a playbook for automated threat response
Playbooks are Azure Logic Apps workflows authored against the Microsoft Sentinel connector and the Microsoft Sentinel Incident / Entity / Alert triggers.
Source: https://maester.dev/docs/tests/ZTA.41214
## Overview
Playbooks are Azure Logic Apps workflows authored against the Microsoft Sentinel connector and the Microsoft Sentinel Incident / Entity / Alert triggers. They execute the orchestrated response actions a SOC needs at machine speed: disable a Microsoft Entra user account, revoke active sessions, block an IP at Defender for Endpoint or the perimeter firewall, isolate a device, post to Microsoft Teams, open a ServiceNow ticket, run a containment script. An automation rule wires the trigger condition (which incidents) to the response (which playbook), closing the SOAR loop. Without a playbook-executing automation rule, response remains entirely manual: a credentialed-account-takeover incident requires a human analyst to acknowledge, triage, locate the affected user, and manually disable in Microsoft Entra, during which time the threat actor continues collection, credential access, and lateral movement. Industry data places median manual containment time at hours; orchestrated containment is sub-minute. The check confirms at least one enabled automation rule has an action whose actionType is RunPlaybook and whose actionConfiguration.logicAppResourceId references a Logic App resource that exists.
## Remediation
- [Automate and run Microsoft Sentinel playbooks](https://learn.microsoft.com/azure/sentinel/automation/run-playbooks)
- [Create and manage Microsoft Sentinel playbooks](https://learn.microsoft.com/azure/sentinel/automation/create-playbooks)
- [Use playbooks with automation rules](https://learn.microsoft.com/azure/sentinel/tutorial-respond-threats-playbook)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | SecOps |
| Category | Security information and event management |
| Product | [Azure](/docs/tests/products/azure) |
| Feature | Microsoft Sentinel |
| Area | Logging and detection |
| Licence | Consumption-based: Microsoft Sentinel |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.