Sentinel

Question 1

Terms

Answer 1

Event Management
Automation and Orchestration
Custom Security Alerts

Connectors
- Defender Connector

• Incident
• Rules
• Playbook - Logic Apps

Question 2

Configure the alert to create an incident

Answer 2

Defender sends alert to Sentinel
Incident is created
Rule is configured to create a playbook

Question 3

How an incident create a FW rule

Answer 3

Incident creates a RULE
RULE creates an Playbook
Playbook invokes LogicApp
LogicApp connects with FW and creates a rule