Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
This playbook responds to Microsoft Sentinel incidents raised from the VaikoraO365_Quarantine_CL custom Log Analytics table. It enriches the incident with classification reasoning, posts a notification to a SOC Teams channel via webhook, and adds a comment to the incident. Designed to pair with the Vaikora for O365 black-box Azure VM that classifies M365 mailbox content and writes quarantine events.
| Attribute | Value |
|---|---|
| Type | Playbook |
| Solution | Vaikora-O365 |
| Source | View on GitHub |
This playbook uses 2 Logic App connectors / built-in actions:
| Connector / Action | Type | Connections | Actions |
|---|---|---|---|
azuresentinel |
Managed | 1 | 2 |
http |
Built-in | 0 | 1 |
azuresentinel (Managed)| Action | Method | Endpoint | Other |
|---|---|---|---|
| Add_Comment_To_Incident | post | /Incidents/Comment |
— |
| Tag_Incident_Vaikora_O365 | put | /Incidents/Tags |
— |
http (Built-in)| Action | Method | Endpoint | Other |
|---|---|---|---|
| Post_Teams_Notification | POST | @parameters('TeamsWebhookUrl') |
— |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊