Skip to main content

Theory — Sentinel Playbooks and SOAR

Mitch Mommers08/06/2026About 3 min

Theory — Sentinel Playbooks and SOAR

In the previous lab, you created analytics rules that fire when conditions are met. In the tuning page, you learned how to reduce noise so those rules produce quality alerts. But what happens after an alert fires?

SOAR (Security Orchestration, Automation, and Response) is where Microsoft Sentinel becomes operational — it lets automated workflows respond to incidents without human intervention.

What Are Playbooks?

A playbook in Microsoft Sentinel is an Azure Logic App that runs when triggered by an incident or alert. It can perform actions across multiple systems:

  • Block a malicious IP at a firewall or network security group
  • Disable a compromised user account in Entra ID
  • Send a message to Microsoft Teams or Slack
  • Create a ticket in ServiceNow, Jira, or Azure DevOps
  • Collect additional data (whois lookups, VirusTotal scans)
  • Isolate a compromised VM from the network

Playbooks are built using Azure Logic Apps — visual workflows that connect to hundreds of services without writing code.

How Playbooks Work

The flow is: Incident created → Automation Rule evaluates conditions → Playbook triggered → Actions executed.

Common Playbook Examples

1. Block Malicious IP at NSG

When an analytics rule detects a malicious IP address, the playbook:

  1. Extracts the IP from the incident entities
  2. Finds the Network Security Group (NSG) protecting the resource
  3. Adds a deny rule for that IP
# Pseudocode — what the playbook logic does
malicious_ip = incident.entities.get_ip_address()
nsg = get_nsg_for_resource(incident.resource_id)
nsg.add_deny_rule(malicious_ip, priority=100)
log(f"Blocked {malicious_ip} in NSG {nsg.name}")

2. Disable Compromised User

When a rule detects suspicious sign-in activity:

  1. Extracts the user principal name from the incident
  2. Disables the account in Entra ID
  3. Forces password reset on next login
  4. Sends notification to the security team and the user's manager

3. Enrich with Threat Intelligence

When a new incident is created:

  1. Extracts entities (IPs, domains, file hashes)
  2. Queries threat intelligence feeds (Microsoft Defender TI, VirusTotal, AlienVault OTX)
  3. Adds threat indicators to the incident
  4. Updates severity based on threat intelligence match

4. Notify and Escalate

When a High-severity incident is created:

  1. Sends message to Microsoft Teams channel
  2. Creates Azure DevOps work item
  3. Sets incident priority based on rules
  4. Assigns to the on-call analyst (rotation-based)

Automation Rules vs. Playbooks

FeatureAutomation RulesPlaybooks
ScopeManage incidents within SentinelInteract with external systems
ActionsTag, change severity, create tasks, send emailBlock IPs, disable users, update tickets, query APIs
ComplexitySimple, no-codeComplex workflows (Logic Apps)
Use case"I want to tag this incident""I want to block this IP and notify the team"

Automation rules are for managing incidents. Playbooks are for responding to them. They work together — an automation rule can trigger a playbook.

AI-Assisted Playbook Creation

Microsoft Sentinel includes tools that help you create and manage playbooks more efficiently:

  • Template-based creation: Start from pre-built playbook templates for common scenarios (alert triage, incident enrichment, automated response)
  • AI-assisted guidance: The portal provides suggestions based on your incident data and recommended actions
  • Built-in connectors: Pre-configured connectors for Microsoft Teams, ServiceNow, Jira, and other common tools

To create a playbook:

  1. Navigate to the Playbooks page in Microsoft Sentinel
  2. Click Create from template or start a new playbook
  3. Choose your trigger (incident created, alert fired) and configure actions
  4. Review and test before deploying

Note: Playbooks run as Azure Logic Apps. Always review generated code for security issues before using it in production.

When to Use Playbooks

ScenarioUse Playbook?Why
Block known-bad IP at firewallYesFast, automated, repeatable
Notify team of new incidentNo — use automation ruleSimpler, built-in
Disable compromised accountYesTime-sensitive, needs external system access
Create ticket in ServiceNowYesIntegrates with external workflow
Enrich with threat intelYesExternal API calls needed

Rule of thumb: If the response requires interacting with an external system or performing multi-step logic, use a playbook. If it's managing the incident within Sentinel, use automation rules.

Key Takeaways

  1. Playbooks are Azure Logic Apps triggered by Sentinel incidents — they automate responses across multiple systems.
  2. Common playbooks: block IP, disable user, enrich with threat intel, notify and escalate.
  3. Automation rules manage incidents; playbooks respond to them. They work together.
  4. Use templates and AI-assisted guidance to create playbooks efficiently; always review before deploying.
  5. Not every alert needs a playbook — start with automation rules for simple tasks.

References

Contributors: Mitch Mommers