This repository provides automation solutions for Microsoft Sentinel. The repository is focused on Logic Apps/Playbooks. The solutions are aimed to:
Presenting this material as your own is illegal and forbidden. A reference to Twitter @BertJanCyber or Github @Bert-JanP is much appreciated when sharing or using the content.
Automation rules can be used to automatically run a playbook once an incident is created or changed.
After the first triage of an incident a security analyst may determine that more information is needed, Playbooks can be used to provide the analyst with this information.
There are different options to trigger the Playbook for execution, one is shown below.
Linux offers powerful command-line tools for system administrators to view and manage user accounts. Knowing…
User management is a critical aspect of Linux administration. Each user in a Linux system…
Managing users is an essential part of Linux system administration. Knowing how to list all…
Nmap (Network Mapper) is a free tool that helps you find devices on a network,…
Introduction to the Model Context Protocol (MCP) The Model Context Protocol (MCP) is an open…
While file extensions in Linux are optional and often misleading, the file command helps decode what a…