Question
Your company is moving all on-premises workloads to Azure and Microsoft 365.
You need to design a security orchestration, automation, and response (SOAR) strategy in Microsoft Sentinel that meets the following requirements:
✑ Minimizes manual intervention by security operation analysts
✑ Supports triaging alerts within Microsoft Teams channels
What should you include in the strategy?
- A. KQL
- B. playbooks Correct
- C. data connectors
- D. workbooks
Explanation
Playbooks in Microsoft Sentinel are Azure Logic Apps workflows that run automatically from automation rules in response to alerts and incidents, which minimizes manual intervention by security operations analysts. Through the Microsoft Teams connector, a playbook can post an alert or incident to a Teams channel and let analysts triage it there. KQL, data connectors and workbooks query, ingest and visualize data but do not automate responses.
