Learning Path 8 - Lab 1 - Exercise 1 - Create a Playbook in Microsoft Sentinel
Lab scenario
You’re a Security Operations Analyst working at a company that implemented Microsoft Sentinel. You must learn how to detect and mitigate threats using Microsoft Sentinel. Now, you want to respond and remediate actions that can be run from Microsoft Sentinel as a routine.
With a playbook, you can help automate and orchestrate your threat response, integrate with other systems both internal and external, and can be set to run automatically in response to specific alerts or incidents, when triggered by an analytics rule or an automation rule.
Important: The lab exercises for Learning Path #8 are in a standalone environment. If you exit the lab before completing it, you will be required to re-run the configurations again.
Task 1: Create a Playbook in Microsoft Sentinel
In this task, you create a Logic App that is used as a Playbook in Microsoft Sentinel.
Note: Microsoft Sentinel has been predeployed and onboarded to Microsoft Defender XDR with the name sentinelworkspace-01, and the required Content Hub solutions have been installed.
-
Log in to WIN1 virtual machine as Admin with the password: Pa55w.rd.
-
Open the Microsoft Edge browser.
-
In the Edge browser, navigate to Defender XDR at
https://security.microsoft.com. -
In the Sign in dialog box, copy, and paste in the Tenant Email account provided by your lab hosting provider and then select Next.
-
In the Enter password dialog box, copy, and paste in the Tenant Password provided by your lab hosting provider and then select Sign in.
Note: You may be prompted to enter the Temporary Access Pass (TAP) instead of a password. This is also provided in the resources tab. If prompted, copy and paste the TAP value and select Sign in.
-
In the Microsoft Defender navigation menu, scroll down and expand the Microsoft Sentinel section.
-
Expand the Content management section and select Content Hub.
-
Within the search bar, look for Sentinel SOAR Essentials.
-
Select the solution that appears in the results.
-
Within the solution details, select Manage.
-
Find the Defender_XDR_Ransomware_Playbook_for_SecOps-Tasks playbook and select the name.
-
Select the Incident tasks - Microsoft Defender XDR Ransomware Playbook for SecOps template.
-
On the details pane, select Create playbook.
-
For Resource Group, select SentinelStatic and select OK.
-
Remove for and the extra underscores from the playbook name (would exceed limit of 64 characters). It should read Defender_XDR_Ransomware_Playbook_SecOps_Tasks.
-
Select Connections.
-
Select Next: Review and create.
-
Now select Create Playbook.
Note: Wait for the deployment to finish before proceeding to the next task.
-
Select the Close and go to playbook button to open the Logic App designer for the playbook.
Task 2: Update a Playbook in Microsoft Sentinel
In this task, you update the new playbook you created with the proper connection information.
-
When the previous task completes you should be in the *Defender_XDR_Ransomware_Playbook_SecOps-Tasks Logic app designer* page. If you aren’t, complete steps 2-7 below. -
In the Search bar of the Azure portal, type Sentinel, then select Microsoft Sentinel.
-
Select your Microsoft Sentinel Workspace.
-
Select Automation under the Configuration area and then select the Active Playbooks tab.
-
Select Refresh from the command bar in case you don’t see any playbooks. You should see the playbook created from the previous step.
-
Select the Defender_XDR_Ransomware_Playbook_SecOps_Tasks playbook name link.
-
On the Logic app designer page for Defender_XDR_Ransomware_Playbook_SecOps_Tasks, in the command menu, select Edit.
Note: You may need to refresh the page.
-
Select the first block, Microsoft Sentinel incident.
-
Select the Change connection* link.
-
Select Add new and select Sign in. In the new window, select your Azure subscription admin credentials when prompted. The last line of the block should now read “Connected to your-Student-username”.
-
Select Save on the command bar.
- Select the X on the window to close it. The Logic App will be used in a future lab.
Task 3: Create an Automation Rule
-
After closing the window in the previous task you should be in the Microsoft Sentinel Automation section.
-
Select + Create and choose Automation Rule.
-
Give the rule a name
-
Leave the Trigger as When an incident is created.
-
Select + Add and choose Condition (And).
-
From the drop-down, select Tactics.
-
Select the Contains operator from the dropdown.
- Select the following tactics Values:
- Reconnaissance
- Execution
- Persistence
- Command and Control
- Exfiltration
- PreAttack
-
Under Actions, select Run Playbook.
-
From the drop-down list, select the Defender_XDR_Ransomware_Playbook_SecOps_Tasks playbook.
-
Select Apply at the bottom.
- Select the X on the Create new automation rule window to close it.
You have now created a playbook and an automation rule in Microsoft Sentinel.