Exam SC-200 topic 3 question 37 discussion

Use playbooks together with automation rules to automate your incident response and remediate security threats detected by Microsoft Sentinel

When you want to add automation for an analytic rule in Sentinel, you configure the rule's Automation rules to define a playbook to execute. Azure Automation runbooks is mainly for automating the provisioning, management, and maintaining

B. Azure Automation runbooks: While runbooks in Azure Automation can automate tasks in the broader Azure environment, they are not directly integrated with Microsoft Sentinel. Playbooks, which are integrated with Sentinel, would be a better choice here.

Correct

Is correct

D. Microsoft Sentinel playbooks: Playbooks are a set of automated tasks that can be triggered by an alert or incident. They can be used to minimize the administrative effort required to respond to incidents and remediate security threats. B. Azure Automation runbooks: Runbooks are a set of PowerShell scripts that can be run on demand or automatically. They can be used to automate tasks such as collecting data, running queries, and sending notifications.

C. Microsoft Sentinel automation rules D. Microsoft Sentinel playbooks Microsoft Sentinel's Automation rules can be used to automatically trigger actions or playbooks in response to detected security incidents. This reduces the need for manual intervention and minimizes administrative effort. Playbooks in Microsoft Sentinel can be used to automate incident response tasks and remediation steps, such as quarantining an affected machine or disabling a compromised account. This allows you to quickly and consistently take action on security incidents, further reducing administrative effort.

Correct! Automation rules help you triage incidents in Microsoft Sentinel. You can use them to automatically assign incidents to the right personnel, close noisy incidents or known false positives, change their severity, and add tags. They are also the mechanism by which you can run playbooks in response to incidents.

réponse : CD