You have a playbook in Azure Sentinel. When you trigger the playbook, it sends an email to a distribution group. You need to modify the playbook to send the email to the owner of the resource…

Question

Options

• AAdd a parameter and modify the trigger.
• BAdd a custom data connector and modify the trigger.
• CAdd a condition and modify the action.
• DAdd a parameter and modify the action.

• A
  9% (6)
• B
  4% (3)
• C
  1% (1)
• D
  85% (57)

Explanation

To change the email recipient from a static distribution group to the dynamic owner of the resource, you need to: (1) Add a parameter to the playbook to accept the resource owner's email address as input at runtime, and (2) Modify the action - specifically the 'Send an email' action - to use that parameter instead of the hard-coded distribution group address. The trigger does not need to change because the condition that fires the playbook remains the same; only what the playbook does (the action) needs updating. Adding a condition (C) introduces branching logic, which is not required here. A custom data connector (B) is unrelated to email routing.

No community discussion yet for this question.