Microsoft Sentinel: automation rules, playbooks and workbooks

Skills you'll practise

• Choose the right automation rule trigger (incident created, incident updated or alert created) for a scenario
• Predict how automation rule order and conditions affect which rules run
• Grant the permissions Microsoft Sentinel needs to run playbooks and assign the right roles to people
• Decide whether a task needs only an automation rule or also a playbook, and explain the cost implication
• Create a workbook from a template and explain what is saved and who can see it

Course outline

1. 1.Automation rulesLesson · 17 min
2. 2.PlaybooksLesson · 17 min
3. 3.WorkbooksLesson · 16 min
4. 4.Microsoft Sentinel: automation rules, playbooks and workbooks: knowledge checkKnowledge check · 14 questions
5. 5.Firewall detections went quietScenario
6. 6.Final exam9 questions · passing it completes the course, so people who already know the material can test out

Sources it draws on

The lessons and questions are written from these references, so learners can go back to the original.

• Microsoft Learn: Automate threat response in Microsoft Sentinel with automation rules
• Microsoft Learn: Automate threat response with playbooks in Microsoft Sentinel
• Microsoft Learn: Visualize your data by using workbooks in Microsoft Sentinel
• Microsoft Learn: Handle false positives in Microsoft Sentinel
• Microsoft Learn: Manage and monitor costs for Microsoft Sentinel
• Microsoft Learn: Monitor the health of your Microsoft Sentinel data connectors