Question

Your SOC wants to build a new Microsoft Sentinel playbook that reacts to incoming incidents. The playbook must run multiple stateful workflows, support local debugging in Visual Studio Code, and be billed based on a fixed hosting plan rather than per-action execution to keep costs predictable for a very high volume of triggered runs. Which Logic App resource type should you choose when creating the playbook?

Accepted Answer

Logic App (Standard) with the Microsoft Sentinel incident trigger

Answer

Logic App (Consumption) with the Microsoft Sentinel incident trigger

Answer

An Azure Function App with a Sentinel HTTP webhook

Answer

A Logic App (Consumption) configured with the alert trigger and an automation rule