Automation
Sentinel Incident Email Alerts: Free Logic App with ARM Template
All right class
One of the most common questions I've been asked in relation to any type of automation is to create a way for managers
Topic
Logic Apps
Free Logic App playbooks for Microsoft Sentinel with ARM templates: incident emails, Teams alerts, triage bots, threat intel and Graph API automation.
7 posts
Automation
Sentinel Incident Email Alerts: Free Logic App with ARM Template
All right class
One of the most common questions I've been asked in relation to any type of automation is to create a way for managers
Microsoft Sentinel
The Nag Machine: A Logic App That Badgers Your Team About Unowned Sentinel Incidents
All right class
Today is a quick one so you can enjoy deploying it without reading a whole lot about this.
The idea is simple - you are getting
Logic Apps
One‑Click Threat Intel: Add IOCs from Sentinel Incidents with a Logic App
All right class.
You’re in an incident. You pivot on an IP. You know it’s bad.
You want it in Threat Intelligence so the next time
Microsoft Sentinel
Sentinel Cost Spike: How To Actually Find The Culprit Table
All right class.
Your CFO walks over and asks why the Azure bill just went up and why “Microsoft Sentinel” is suddenly the top line item.
You open
Automation
The Self-Updating Watchlist: Automating Sentinel with Logic Apps & Graph API
Alright, class.
Let's talk about one of the most powerful tools in your Sentinel armoury: the Watchlist. It's how you teach Sentinel about your
Microsoft Sentinel
The "Undo" Button for Sentinel Logs: An In-Depth Guide to Purging Data
Alright, class.
Let's talk about the "I have made a terrible, expensive mistake" moment.
You just onboarded a new data source. You thought you
Microsoft Sentinel
Microsoft Sentinel: Let the Robots Do the Work - Your First Automation Playbook
Alright, class, let's talk about burnout. Specifically, the burnout that comes from the first five minutes of every single incident. A high-severity alert fires. Now
Get the next post by email
One email per post, plus the KQL Vault. That's the whole deal.