SA0.6 NE's Automation Landscape

Auditing the current state

Start with what exists. Every M365 E5 environment has automation capabilities deployed by default. The problem is that nobody on the security team knows what they are or whether they work.

Defender XDR Auto Investigation and Response. NE enabled AIR during the initial Defender deployment in 2023. Nobody has reviewed the configuration since. The action center (security.microsoft.com → Action center) shows 847 automated actions in the last 90 days — quarantined emails, blocked files, and 12 account containment actions. Twelve accounts were automatically contained by Defender without anyone on the SOC team knowing. Three of those containment actions were on VIP accounts. Nobody reviewed them. Nobody verified whether the containment was appropriate or whether the users experienced disruption.

This is the danger of invisible automation. Defender AIR is powerful, but if nobody monitors it, false positive containment goes unnoticed, legitimate automated actions are not documented in incident reports, and the SOC team makes manual containment decisions for incidents that Defender has already partially contained — creating conflicting response actions.

Action item: Review the Defender action center weekly. Understand what AIR is doing. Document AIR actions in incident reports. Configure AIR policies to match your organisation’s risk tolerance.

Sentinel automation rules. NE has four automation rules:

Rule 1: Change severity from Medium to High for alerts containing “AiTM” in the title. This is useful — AiTM alerts are consistently High severity regardless of the detection’s default severity.

Rule 2: Assign all incidents from the “Microsoft Entra ID Protection” connector to the SOC queue. This works but adds no value — all incidents go to the SOC queue by default.

Rule 3: Close all incidents with severity “Informational” after 72 hours. This is problematic — some informational alerts escalate in severity when correlated with other signals. Auto-closing them prevents correlation.

Rule 4: Auto-assign High severity incidents to “j.morrison.” This is a single-point-of-failure — when j.morrison is on leave, High severity incidents are assigned to an absent analyst.

The dead playbook. Six months ago, an analyst built a playbook that queried VirusTotal for file hashes extracted from Defender for Endpoint alerts. The playbook worked for two weeks. Then VirusTotal’s free API rate limit changed, the playbook started failing, and nobody noticed because no monitoring was configured. The playbook has been in a failed state for six months, creating the impression that “we tried automation and it didn’t work.”

What is missing

The gaps are more important than the existing automation. NE’s SOC has zero:

Enrichment playbooks. Every enrichment query is manual. When an AiTM alert fires, the analyst opens a new browser tab, navigates to Sentinel, types a KQL query for the user’s sign-in history, reads the results, copies the relevant findings, pastes them into the incident comment, and repeats for each enrichment source (IP reputation, device compliance, alert history). Five enrichment queries × 2 minutes each × 500 alerts per day = 83 hours of manual enrichment.

Evidence collection playbooks. Evidence is collected after the analyst triages the alert — typically 45 minutes to 2 hours after the alert fires. By that time, session tokens have expired (1-hour default for Azure AD tokens), short-lived processes have terminated, and the attacker may have moved laterally. A collection playbook that fires on incident creation captures this evidence immediately.

Notification playbooks. The SOC uses email to notify stakeholders. The email is manually composed by the triaging analyst during an active incident — taking attention away from the investigation. There is no Teams channel for SOC notifications, no automated ticket creation, no MSSP coordination playbook, and no after-hours escalation mechanism.

Containment playbooks. All containment is manual. When an AiTM is confirmed, the analyst opens the Entra admin center, finds the user, revokes sessions, navigates to MFA settings, removes the compromised method, checks for inbox rules, checks for mailbox delegates, and documents every action. This takes 15-25 minutes — during which the attacker may be adding additional persistence.

MSSP coordination. BlueVoyant (NE’s managed SOC partner) monitors the same Sentinel workspace. When BlueVoyant triages an alert and NE triages the same alert independently, both teams do the same work. There is no automated mechanism to indicate “BlueVoyant is triaging this” or “NE has taken ownership.”

The target-state architecture

The target state after completing this course is not “automate everything.” It is “automate the right things with the right safeguards, and preserve human judgment for the rest.”

Tier 1 automation (deployed Month 1): Six enrichment playbooks covering every incident type. IP reputation from TI feeds + AbuseIPDB. User risk from Entra ID Protection. Device compliance from Intune. Threat intelligence correlation from Sentinel TI tables. Alert history from previous incidents. Geo-location and impossible travel analysis. Every incident is enriched in under 30 seconds. The analyst opens an investigation-ready incident, not a raw alert.

Tier 2 automation (deployed Month 2): Three evidence collection playbooks (AiTM, endpoint, email) that capture volatile evidence at alert time. Notification pipeline with Teams adaptive cards (SOC channel), email templates (CISO for Critical), ticket creation (ServiceNow), on-call escalation (after-hours High/Critical), and MSSP coordination (auto-assign ownership to avoid duplicate triage).

Tier 3 automation (deployed Month 3): Identity containment for AiTM (session revocation + MFA reset on 95%+ confidence detection). Endpoint containment for workstations (auto-isolate on high-confidence malware/ransomware detection). Both with VIP watchlist checks, blast radius assessment, and rollback playbooks. Server containment routed to approval gates.

Governance (ongoing): Automation health dashboard in Sentinel (Logic App success rates, execution latency, containment action count, FP rate). Monthly review: tune thresholds, retire underperforming automation, promote validated enrichments to higher tiers. Every playbook has a documented runbook.