This repository provides automation solutions for Microsoft Sentinel. The repository is focused on Logic Apps/Playbooks. The solutions are aimed to:
Presenting this material as your own is illegal and forbidden. A reference to Twitter @BertJanCyber or Github @Bert-JanP is much appreciated when sharing or using the content.
Automation rules can be used to automatically run a playbook once an incident is created or changed.
After the first triage of an incident a security analyst may determine that more information is needed, Playbooks can be used to provide the analyst with this information.
There are different options to trigger the Playbook for execution, one is shown below.
The rsync command in Linux synchronizes files and directories between two locations, locally or over SSH. Unlike scp,…
The patch command in Linux applies a set of changes from a diff file to one or…
The basename command in Linux extracts the last component of a file path, removing the leading directory…
The timeout command in Linux runs a command with a time limit and terminates it when the limit is reached. It is part of GNU coreutils, available on virtually every Linux distribution. It is most useful for commands with no built-in timeout option, such as ping, curl, tcpdump, or a custom script that might hang indefinitely. How the timeout Command Works in Linux The syntax is: bashtimeout [OPTIONS] DURATION COMMAND [ARG]...…
The rmmod command in Linux removes a loaded module from the running kernel. Because the kernel has…
The free command in Linux gives you a quick summary of RAM and swap usage. It reads…