Microsoft · SC-200
Automation in Microsoft Sentinel
SC-200 · Lesson 4 of 14 · 20:14
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the SC-200 exam (Microsoft Certified: Security Operations Analyst Associate). In this lesson: automation rules (incident created, incident updated, and alert created triggers, conditions, actions, order, expiration), playbooks built on Azure Logic Apps (incident and alert triggers, manual runs, Consumption and Standard), and the roles needed to run them, including Microsoft Sentinel Automation Contributor. Includes three original practice questions.
Preview the topics
- During a two-week penetration test, incidents from the test machines must close automatically, and the rule must stop on its own when the test ends. What should the engineer use?
- For every new incident that involves a user account, a workflow must open a ticket in an external IT service management tool. What should the engineer build?
- An automation rule is set to run a playbook, but the playbook never starts, even though the engineer is a Microsoft Sentinel Contributor. What is most likely missing?