From the course: Microsoft Security Operations Analyst Associate (SC-200) Cert Prep by Microsoft Press

Unlock this course with a free trial

Join today to access over 24,900 courses taught by industry experts.

Configure analytic rules to trigger automation

Configure analytic rules to trigger automation

From the course: Microsoft Security Operations Analyst Associate (SC-200) Cert Prep by Microsoft Press

Start my 1-month free trial Buy for my team

Configure analytic rules to trigger automation

“

- [Instructor] Moving into configuring analytic rules to trigger automation. To run the playbook automatically on incident creation, we will need to add it to the automation rule by using the when an incident is created trigger and run playbook as the action. As discussed in the first part of this lesson, we create a new automation rule and then select the analytics rule name for which this playbook will run. In our case, the analytics rule is called test malicious URL, and then we choose our playbook under actions. You can run it on all active analytics rules based on a playbook scenario you create. This is how we can run our newly created playbook. Okay. You can also create an automation rule from the incidents blade directly to respond to a single recurring incident. And this is useful when creating a suppression rule for automatically closing noisy incidents. So you can select an incident from the queue and then…

Contents