Automation Rules vs Playbooks in Sentinel

Microsoft Sentinel provides two primary mechanisms for automating incident response: Automation Rules and Playbooks. Both are designed to reduce manual effort and speed up response times, but they operate at different levels and have distinct capabilities.

Automation Rules are lightweight, rule-based triggers that run automatically when an incident is created or updated. They allow you to perform simple actions such as changing incident status, assigning severity, adding tags, or triggering a playbook. Automation rules are evaluated sequentially based on their order (priority) and can include conditions based on incident properties like severity, tactics, or specific entity types.

Playbooks are more complex workflows built on Azure Logic Apps. They can execute a series of actions, including querying external systems (e.g., threat intelligence feeds, ticketing systems), sending email notifications, creating tickets in ServiceNow, or even blocking IP addresses in firewalls. Playbooks can be triggered by automation rules, manually from an incident, or directly from alerts.

When an incident is created or updated in Sentinel, the following sequence occurs: 1. Sentinel evaluates all active automation rules in order of their defined priority (a numeric value from 0 to 1000, where lower numbers run first). 2. For each rule, Sentinel checks if the incident matches the rule's conditions (e.g., severity equals High, tactic equals CredentialAccess). 3. If conditions are met, Sentinel executes the rule's actions sequentially. Actions can include: - Change incident properties: Modify status (New, Active, Closed), severity (Low, Medium, High, Informational), owner (assign to a specific user or group), or add tags. - Trigger a playbook: Launch a specified playbook (which runs asynchronously). - Run a playbook on the incident: The playbook receives the incident as input and can perform complex actions. 4. After executing the rule, Sentinel proceeds to the next rule unless the rule has the option "Stop processing further automation rules" enabled (similar to a break in a switch statement).

Key details: - Automation rules run within the Sentinel platform and do not incur additional costs beyond Sentinel's pricing. - They are evaluated synchronously for incident creation; for updates, they run asynchronously. - The maximum number of automation rules is 512 per workspace. - Each rule can have up to 50 conditions (combined with AND/OR logic).

Playbooks are Azure Logic Apps resources that are triggered by a webhook from Sentinel. When a playbook is triggered (either by an automation rule or manually), the following happens: 1. Sentinel sends an HTTP POST request to the Logic App's callback URL with a JSON payload containing the incident details (e.g., incident ID, title, severity, entities, alerts). 2. The Logic App receives the payload and begins executing its workflow, which can include: - Triggers: The playbook must start with a Sentinel trigger (e.g., "When a response to a Microsoft Sentinel incident is triggered"). - Actions: These can be connectors to Azure services (e.g., Azure AD, Microsoft Teams, Azure Automation) or third-party services (e.g., ServiceNow, Slack, AWS). - Conditions and loops: Logic Apps support complex logic including conditional branches, parallel actions, and loops. 3. The playbook can also update the incident by calling the Sentinel API (e.g., to add comments, change status, or add tags). 4. The playbook runs asynchronously from the automation rule that triggered it. This means the automation rule continues to the next rule without waiting for the playbook to complete.

Key details: - Playbooks incur Azure Logic Apps pricing based on execution time and number of actions. - They support both Standard and Consumption Logic Apps. Standard offers better performance and VNET integration; Consumption is simpler and cheaper for low-volume use. - Playbooks can be triggered manually from an incident by clicking "Actions > Run Playbook." - They can also be triggered from alerts (Preview feature) to respond to individual alerts before they are grouped into incidents.

Use Automation Rules when: - You need a simple, fast action on incident creation/update (e.g., auto-close low-severity incidents, assign incidents to a specific analyst, add a tag for compliance). - You want to trigger a playbook based on incident properties. - You need to enforce a standard workflow (e.g., always assign incidents of type 'Malware' to the malware team). - Performance is critical; automation rules execute within seconds.

Use Playbooks when: - You need to interact with external systems (e.g., create a ticket in ServiceNow, query VirusTotal, block an IP in Palo Alto). - You need complex logic with multiple steps, conditions, and loops. - You need to perform actions that take longer than a few seconds (e.g., waiting for a user response, polling an external API). - You need to reuse the same workflow across multiple automation rules or manually.

Automation rules can trigger playbooks, but playbooks cannot trigger automation rules. This is a one-way relationship. However, a playbook can update an incident, which might then trigger another automation rule if the update matches its conditions. For example: 1. An automation rule triggers a playbook when an incident of severity High is created. 2. The playbook queries an external threat intel service and finds the incident is a false positive. 3. The playbook updates the incident status to Closed with a classification of "FalsePositive." 4. This update triggers another automation rule that has a condition for closed incidents, which might send a notification to the SOC manager.

Creating an Automation Rule: - Navigate to Automation > Create > Add new rule. - Define the trigger (When incident is created, When incident is updated, or both). - Set conditions (e.g., If severity equals High AND tactic equals InitialAccess). - Define actions (e.g., Change severity to Medium, Add tag 'review', Run playbook 'Investigate-IP'). - Set order (priority) and optionally enable "Stop processing further automation rules."

Creating a Playbook: - Navigate to Automation > Playbooks > Add playbook. - Choose a Logic Apps plan (Consumption or Standard). - Design the workflow in the Logic Apps designer. The trigger must be "Microsoft Sentinel incident." - Add actions using connectors. Common actions include: - Microsoft Teams: Post a message to a channel. - Azure Automation: Run a runbook to block an IP. - ServiceNow: Create an incident. - HTTP: Call any REST API. - Save the playbook. Note: The playbook must be granted permissions to Sentinel (via Managed Identity or Service Principal) to update incidents.

Verifying Execution: - Automation rules: Check the Sentinel logs in the Automation blade under "Run history." You can see which rules ran and whether they succeeded. - Playbooks: Check the Logic App's run history in the Azure portal. Each run shows input, output, and any errors.