Playbooks

For more information on how to build and deploy Playbooks, please see https://learn.microsoft.com/en-us/azure/sentinel/sentinel-playbook-creation

Name		Name	Last commit message	Last commit date
parent directory ..
.template		.template
2S-Sentinel2MISP		2S-Sentinel2MISP
AD4IoT-AutoCloseIncidents		AD4IoT-AutoCloseIncidents
AD4IoT-MailbyProductionLine		AD4IoT-MailbyProductionLine
AD4IoT-NewAssetServiceNowTicket		AD4IoT-NewAssetServiceNowTicket
AD4IoT-TritonDetectionAndResponse		AD4IoT-TritonDetectionAndResponse
ADX-Health-Playbook		ADX-Health-Playbook
AS-AI-Commandline-Analysis		AS-AI-Commandline-Analysis
AS-Add-Azure-AD-User-Job-Title-to-Incident		AS-Add-Azure-AD-User-Job-Title-to-Incident
AS-Add-Machine-Logon-Users-to-Incident		AS-Add-Machine-Logon-Users-to-Incident
AS-Azure-AD-Disable-User		AS-Azure-AD-Disable-User
AS-Azure-AD-Enable-User		AS-Azure-AD-Enable-User
AS-Azure-AD-Group		AS-Azure-AD-Group
AS-Blob-Storage-Add-Domains-to-Zscaler-URL-Category		AS-Blob-Storage-Add-Domains-to-Zscaler-URL-Category
AS-Block-GitHub-User		AS-Block-GitHub-User
AS-Block-Hash-in-Defender		AS-Block-Hash-in-Defender
AS-Checkmarx-Audit-Ingestion		AS-Checkmarx-Audit-Ingestion
AS-Checkmarx-SAST-Ingestion		AS-Checkmarx-SAST-Ingestion
AS-Clear-Okta-Network-Zone-List		AS-Clear-Okta-Network-Zone-List
AS-Compromised-Machine-Tagging		AS-Compromised-Machine-Tagging
AS-Create-Opsgenie-Incident		AS-Create-Opsgenie-Incident
AS-Crowdstrike-Alerts-Integration		AS-Crowdstrike-Alerts-Integration
AS-Datadog-Events-Integration		AS-Datadog-Events-Integration
AS-Delete-App-Registration		AS-Delete-App-Registration
AS-Disable-Microsoft-Entra-ID-User-From-Entity		AS-Disable-Microsoft-Entra-ID-User-From-Entity
AS-Edgescan-Integration		AS-Edgescan-Integration
AS-Enable-Microsoft-Entra-ID-User-From-Entity		AS-Enable-Microsoft-Entra-ID-User-From-Entity
AS-IAM-Entra-ID-Master-Playbook		AS-IAM-Entra-ID-Master-Playbook
AS-IAM-Master-Playbook		AS-IAM-Master-Playbook
AS-IP-Blocklist-Remove-IPs		AS-IP-Blocklist-Remove-IPs
AS-IP-Blocklist		AS-IP-Blocklist
AS-Import-Azure-AD-Group-Users-to-MS-Watchlist		AS-Import-Azure-AD-Group-Users-to-MS-Watchlist
AS-Incident-Host-Exposure-Level		AS-Incident-Host-Exposure-Level
AS-Incident-IP-Matched-on-Watchlist		AS-Incident-IP-Matched-on-Watchlist
AS-Incident-Response-Approval-Email		AS-Incident-Response-Approval-Email
AS-Incident-Spiderfoot-Scan		AS-Incident-Spiderfoot-Scan
AS-MDE-Isolate-Machine		AS-MDE-Isolate-Machine
AS-MDE-Unisolate-Machine		AS-MDE-Unisolate-Machine
AS-Make-GitHub-Repository-Private		AS-Make-GitHub-Repository-Private
AS-Microsoft-DCR-Log-Ingestion		AS-Microsoft-DCR-Log-Ingestion
AS-MuleSoft-Integration		AS-MuleSoft-Integration
AS-Okta-NetworkZoneUpdate		AS-Okta-NetworkZoneUpdate
AS-PagerDuty-Integration		AS-PagerDuty-Integration
AS-Recurring-Host-Entity		AS-Recurring-Host-Entity
AS-Remove-Domains-from-Zscaler-URL-Category		AS-Remove-Domains-from-Zscaler-URL-Category
AS-Revoke-Azure-AD-User-Session-From-Entity		AS-Revoke-Azure-AD-User-Session-From-Entity
AS-Revoke-Azure-AD-User-Session-From-Incident		AS-Revoke-Azure-AD-User-Session-From-Incident
AS-Sign-Out-Google-User		AS-Sign-Out-Google-User
AS-Slack-Integration		AS-Slack-Integration
AS-Terminate-Okta-User-Session-From-Entity		AS-Terminate-Okta-User-Session-From-Entity
AS-Update-Okta-Network-Zone-From-Entity		AS-Update-Okta-Network-Zone-From-Entity
Add-IP-Entity-To-NSG		Add-IP-Entity-To-NSG
Add-IP-Entity-To-Named-Location		Add-IP-Entity-To-Named-Location
Affected-Key-Credentials-CVE-2021-42306		Affected-Key-Credentials-CVE-2021-42306
Aggregate-ServiceNow-tickets		Aggregate-ServiceNow-tickets
AutoConnect-ASCSubscriptions		AutoConnect-ASCSubscriptions
AzureMonitor-ManagedId		AzureMonitor-ManagedId
Block-AADUserOrAdmin		Block-AADUserOrAdmin
Block-ExchangeIP		Block-ExchangeIP
Block-IPs-on-MDATP-Using-GraphSecurity		Block-IPs-on-MDATP-Using-GraphSecurity
Block-OnPremADUser		Block-OnPremADUser
Change-Incident-Severity		Change-Incident-Severity
CiscoASA		CiscoASA
Close-Incident-MCAS		Close-Incident-MCAS
Close-SentinelIncident-fromServiceNow		Close-SentinelIncident-fromServiceNow
Comment-OriginAlertURL		Comment-OriginAlertURL
Comment-RemediationSteps		Comment-RemediationSteps
Create Incidents From Http		Create Incidents From Http
Create Incidents with Email		Create Incidents with Email
Create-AzureDevOpsTask		Create-AzureDevOpsTask
Create-AzureSnapshot		Create-AzureSnapshot
Create-IBMResilientIncident		Create-IBMResilientIncident
Create-Incident-on-missing-Data-Source		Create-Incident-on-missing-Data-Source
Create-Zendesk-Ticket		Create-Zendesk-Ticket
CrowdSecurity-Suspicious-Login-Detection		CrowdSecurity-Suspicious-Login-Detection
CrowdStrike		CrowdStrike
CybleLogicApp		CybleLogicApp
Dismiss_Upstream_Events		Dismiss_Upstream_Events
Dynamic-Summaries-API-Upsert		Dynamic-Summaries-API-Upsert
Enrich-AzureResourceGraph-Incident		Enrich-AzureResourceGraph-Incident
Enrich-AzureResourceGraph		Enrich-AzureResourceGraph
Enrich-CIRCL-hashlookup		Enrich-CIRCL-hashlookup
Enrich-Intezer-Analyze		Enrich-Intezer-Analyze
Enrich-MalwareBazaar		Enrich-MalwareBazaar
Enrich-Sentinel-Incident-AlienVault-OTX		Enrich-Sentinel-Incident-AlienVault-OTX
Enrich-SentinelIncident-GreyNoise-IP		Enrich-SentinelIncident-GreyNoise-IP
Enrich-SentinelIncident-GreyNoiseCommunity-IP		Enrich-SentinelIncident-GreyNoiseCommunity-IP
Enrich-SentinelIncident-MDATPTVM		Enrich-SentinelIncident-MDATPTVM
Export-Incidents-With-Comments		Export-Incidents-With-Comments
Export-Report-CSV		Export-Report-CSV
F5BigIP		F5BigIP
ForcepointNGFW		ForcepointNGFW
Fortinet-FortiGate		Fortinet-FortiGate
Get-AD4IoTDeviceCVEs		Get-AD4IoTDeviceCVEs
Get-ASCRecommendations		Get-ASCRecommendations
Get-AlertEntitiesEnrichment		Get-AlertEntitiesEnrichment
Get-AlienVault_OTX		Get-AlienVault_OTX
Get-CompromisedPasswords		Get-CompromisedPasswords
Get-GeoFromIPandTagIncident-EmailAlertBasedonGeo		Get-GeoFromIPandTagIncident-EmailAlertBasedonGeo
Get-GeoFromIpAndTagIncident		Get-GeoFromIpAndTagIncident

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ReadMe.md

FilesExpand file tree

Playbooks

Directory actions

More options

Directory actions

More options

Latest commit

History

Playbooks

Folders and files

parent directory

ReadMe.md