SA1.2 Playbooks — The Power Layer

Logic Apps for security — what you need to know

Logic Apps is a broad platform used for enterprise integration, workflow automation, and API orchestration across hundreds of use cases. For security automation, you need approximately 10% of the platform’s capability. This sub focuses on the 10% that matters.

A Logic App is a sequence of steps. Each step is an action from a connector. The Sentinel connector provides the trigger (“When Microsoft Sentinel incident is created”) and incident manipulation actions (add comment, change severity, change status). The Microsoft Graph connector provides identity operations (get user, revoke sessions, list group members). The MDE connector provides endpoint operations (isolate device, run live response). The Teams connector sends messages and adaptive cards. The HTTP connector calls any REST API.

Steps execute sequentially by default. You can add parallel branches (execute two API calls simultaneously), conditions (if user is VIP, do X; else do Y), loops (for each IP entity, query TI feed), and scopes (group steps for shared error handling).

Every step produces output. The output is available to subsequent steps as “dynamic content” — a picker in the designer that lets you reference values from previous steps. When the Sentinel trigger fires, its output includes the incident object: title, severity, description, entities, alerts, and custom properties. When you add a “Get user” action from the Graph connector, its output includes the user’s display name, job title, department, and risk level. You reference these outputs in subsequent steps to build the enrichment comment, the Teams notification, or the containment decision logic.

The five-step playbook pattern

Every Sentinel playbook follows the same five-step pattern. The steps vary in complexity, but the pattern is consistent:

Step 1: Trigger. The playbook fires when a Sentinel incident is created or updated. The trigger provides the incident object with all its properties and entities.

Step 2: Extract entities. The incident contains entities — accounts, IPs, hosts, URLs, files — but they are in a JSON array that requires parsing. You extract the entity you need (the Account entity for identity enrichment, the IP entity for TI lookup) and store it in a variable or pass it directly to the next action.

Step 3: Query external data. Call APIs to gather enrichment data, collect evidence, or check containment prerequisites. This is where the connector ecosystem matters: Graph API for identity data, MDE API for endpoint data, HTTP action for any REST API, and the Sentinel connector’s “Run query” action for KQL queries against the workspace.

Step 4: Apply conditional logic. Based on the query results, decide what to do. If the user’s risk level is High AND the IP is not on the known-safe watchlist AND the detection confidence is above 95%, execute containment. If the user is on the VIP watchlist, route to the approval gate instead. If any query failed (API timeout, permission error), skip to the error handling path.

Step 5: Execute and document. Take the appropriate action: add an enrichment comment to the incident, send a Teams notification, execute containment, or present an approval request. Always add the final action as an incident comment documenting what the playbook did — this creates the audit trail.

Connectors you will use in this course

Microsoft Sentinel connector. Trigger: “When Microsoft Sentinel incident is created.” Actions: Add comment to incident, Update incident (change severity, status, owner, tags), Get incident, List incidents. The Sentinel connector authenticates via managed identity — enable the system-assigned managed identity on the Logic App and grant it “Microsoft Sentinel Responder” role on the workspace.

Microsoft Graph connector (via HTTP action). The Graph API connector in Logic Apps is limited. For security automation, use the HTTP action to call Graph directly with managed identity authentication. Endpoints you will use: /users/{id} (get user profile), /users/{id}/revokeSignInSessions (revoke sessions), /users/{id}/authentication/methods (MFA methods), /identityProtection/riskyUsers/{id} (risk status). Grant the managed identity the specific Graph permissions required — User.Read.All for enrichment, User.RevokeSessions.All for containment.

Log Analytics connector. Run KQL queries against the Sentinel workspace from within the playbook. This is how you query SigninLogs, AuditLogs, ThreatIntelligenceIndicator, and _GetWatchlist() from inside a Logic App. The results are returned as a JSON table that you parse and include in the enrichment comment.

Teams connector. Post messages and adaptive cards to Teams channels. Adaptive cards support rich formatting (tables, severity badges, entity lists) and interactive elements (Approve/Reject buttons for human-in-the-loop workflows). The Teams connector authenticates via the connection creator’s account — this means someone must create the Teams connection and authorize it.

HTTP connector. Call any REST API. VirusTotal, AbuseIPDB, Shodan, ServiceNow, Jira, Palo Alto, custom internal APIs. The HTTP connector handles GET, POST, PUT, PATCH, DELETE. Authentication options: API key (in header or query), OAuth (client credentials flow), managed identity (for Azure APIs), or no auth (for public APIs).

Dynamic content and expressions

Dynamic content is the mechanism that passes data between steps. When you add a “Compose” action, you can reference values from previous steps using the dynamic content picker — click “Add dynamic content” and select from a list of available values (incident title, incident severity, user display name, etc.).

For complex data manipulation, you use expressions — Logic App’s formula language. Expressions look like: @{triggerBody()?['object']?['properties']?['severity']} — which extracts the severity value from the trigger payload. The syntax is verbose but learnable. Key expressions you will use:

triggerBody() — the complete trigger payload (the incident object). body('action_name') — the output of a specific action. items('For_each') — the current item in a For Each loop. if(condition, true_value, false_value) — inline conditional. length(collection) — count items in an array. json(string) — parse a string as JSON.

You do not need to memorise these. The designer provides autocomplete, and every sub in this course shows the exact expressions for each playbook step.