Building Microsoft Sentinel Usecases with automation using playbooks

[@willemplug3366]

Love the time and effort you put in the coffee edit😁

[@yt0ng646]

You are doing a fantastic job here, thanks a lot !

[@Christian-np6je]

Awesome video and summary! Thanks a lot!

[@polonia66]

HI, thank you for your great videos. I have question about 42:51 If i would like to set playbook to block the user, what is the best way to do it? as i can see in your case - you add URL with username? so this playbook will be just for one user, how to do with case of any user?

[@AzureVlog]

You can use variables in the URI of the HTTP activity. You use the "Entities - Get Account" activity to retrieve the username. Then use that username as variable in the URI. It is actually quite bad that I "hardcoded" the username in the URI of the HTTP activity.

[@polonia66]

@@AzureVlog thank you so much!

[@shijin_suresh]

Great Job! Thanks

[@motorhead1791]

In sentinel log in OperationName column nothing is appearing what to do?

[@wilkinsanchez8737]

Excellent video. How do you keep track of your expenses when doing these labs? How much money do you usually spend? Is there a way I could do things like this in a lab environment without worrying for a big bill?

[@AzureVlog]

As long as you don't ingest that much data into Microsoft Sentinel, it isn't expensive. You pay per GB that gets ingested into Sentinel. Another way to keep things within budget, is to delete resources after finishing your lab.

[@paul.delasaux]

Keep it up! These are good.

[@bala007raju]

very nice video , thanks lot

[@progod6017]

Good video

[@jytan740]

is there any guide that can help splunk users translate from SPL to KQL?

[@IamSahilVerma]

First like from Canada..

[@IamSahilVerma]

First like from Canada...