AZ-500 Question 273
Select 3Your organization frequently encounters suspicious IP addresses in high-severity incidents within Microsoft Sentinel. You have been asked to configure an automation rule that triggers a playbook whenever a high-severity incident is created. The playbook will then call an external quarantine API, passing the suspicious IP address from the incident’s context. Which of the following steps are required to accomplish this goal?
- A
Configure the 'Microsoft Sentinel Incident' trigger in your Logic App so it can accept and process incident details from Sentinel.
- B
Create an automation rule in Microsoft Sentinel that checks if the incident severity is 'High' and, if so, runs the newly created Logic App.
- C
In the Logic App, add actions (such as an HTTP POST request) to call the external quarantine API and pass the suspicious IP address from the incident payload.
- D
Directly specify the quarantine API parameters in the Analytics rule editor, without creating a separate Logic App.
Show answer and explanation
Correct answers: A, B, C
Explanation
To automate incident response in Microsoft Sentinel, you typically create an automation rule that filters incidents by defined criteria (such as severity) and triggers a Logic App playbook. The Logic App must include the 'Microsoft Sentinel Incident' trigger to receive incident details and then perform the required actions, like calling an external quarantine API. This approach follows Microsoft’s recommended best practices for incident automation in Sentinel. For more information, refer to the official documentation: https://docs.microsoft.com/azure/sentinel/automate-incident-handling-with-automation-rules.
- A. Correct.
Correct. Using the 'Microsoft Sentinel Incident' trigger in the Logic App ensures the playbook can receive details about the new high-severity incident, including IP address data.
- B. Correct.
Correct. Configuring a condition in the automation rule to match 'High' severity incidents allows Sentinel to invoke the playbook only for relevant scenarios.
- C. Correct.
Correct. After receiving incident data, the Logic App can use an HTTP action or similar connector to call the external API, passing parameters (such as the suspicious IP address) from the incident context.
- D. Incorrect.
Incorrect. While Analytics rules can generate incidents, embedding the quarantine steps directly in the Analytics rule editor is not the recommended approach. The proper way is to attach a playbook through automation rules or directly link it within the rule’s automated response. In modern best practices, automation rules are the primary method to trigger playbooks for consistent and centralized incident handling.