Question

Your SOC uses Microsoft Sentinel. You built a Logic Apps playbook that enriches incidents by querying an external threat intelligence API and adding the results as a comment. You want the playbook to run automatically whenever any new incident is created by a specific high-fidelity analytics rule, without requiring an analyst to trigger it manually. What should you configure, and what permission must be granted?

Accepted Answer

Create an automation rule with an incident-creation trigger and a condition on the analytics rule name; grant the Sentinel Automation Contributor role to Sentinel on the playbook's resource group.

Answer

Add the playbook directly to the analytics rule's alert-trigger automation and grant the playbook's managed identity the Sentinel Reader role.

Answer

Configure a scheduled automation rule that runs every 5 minutes to poll for new incidents and grant the Logic Apps Contributor role to each analyst.

Answer

Create an automation rule with an alert-creation trigger and grant the Microsoft Sentinel Responder role to the playbook's managed identity.