Hands On: Microsoft Sentinel SOAR with Logic App & Playbooks

Explore how logic apps automate, orchestrate, and schedule security workflows within Microsoft Sentinel. Learn to trigger playbooks, integrate with Teams or email notifications, and respond to incidents efficiently.

Create a sentinel logic app that uses the legacy agent to monitor security events, connect to a Windows VM, and automatically shut it down when a specific event ID occurs.

Connect a VM to Microsoft Sentinel, configure a data connector and analytic rule, and trigger a logic app playbook to generate incidents and turn off VM when logs are cleared.

Configure and test a legacy agent security flow in Microsoft Sentinel, linking an incident analytics rule to a VM shutdown playbook via a logic app with explicit permissions and automation.

Automate blocking of malicious IPs in Microsoft Sentinel by ingesting threat intel via the taxi data connector, then add IP ranges to a named location in a conditional access policy.

Practice adding an IP to a named location to block with Microsoft Sentinel, Logic Apps, and Playbooks, including building analytic rules, entity mapping, and incident automation.

Troubleshoot a logic app playbook in Microsoft Sentinel by diagnosing a name location fetch failure, configuring an Azure Active Directory app registration, and granting Graph API permissions.

Explore adding threat intel IP addresses to a named location and blocking access via conditional access policies using Microsoft Sentinel, Logic Apps, and Playbooks.

Enable VirusTotal IP enrichment in the Sentinel playbook by querying IP address reports for each IP and enriching incidents with VirusTotal data to reveal malicious characteristics, enabling automated responses.

Analyze Microsoft Sentinel logs to view enriched IP attributes and last 30 minutes reports, then use enriched data to decide blocking IPs at the firewall.

Design a logic app flow to fetch malicious IP addresses with VirusTotal, block them via firewall policies and IP groups, and notify teams.

Design a logic app flow to automate firewall policy actions, integrate IP groups and custom connectors, and deploy playbooks in Microsoft Sentinel SOAR for incident-driven responses.

Explore how to design and test a logic app flow, trigger incidents via analytics, and use a playbook to block an IP address through a firewall.

Learn to block ip addresses at scale using Microsoft Sentinel soar with Logic Apps and Playbooks, building ip groups and incident workflows via Teams adaptive cards.

Master must-know logic app concepts from a sentinel perspective, including app registration, permissions, secrets, manager entity, and roles like logic app contributor and operator for secure automation.

Automate fetching terminated employee data from an outlook email attachment with a logic app. Store the attachment in blob storage and update the sentinel watch list using a sas url.