SC-200 · Question #38
You have an Azure Sentinel workspace. You need to test a playbook manually in the Azure portal. From where can you run the test in Azure Sentinel?
The correct answer is D. Incidents. Manual triggering is available from the Azure Sentinel portal in the following blades: In Incidents view, choose a specific incident, open its Alerts tab, and choose an alert. In Investigation, choose a specific alert. Click on View playbooks for the chosen alert. You will get…
Question
You have an Azure Sentinel workspace. You need to test a playbook manually in the Azure portal. From where can you run the test in Azure Sentinel?
Options
- APlaybooks
- BAnalytics
- CThreat intelligence
- DIncidents
How the community answered
(24 responses)- A4% (1)
- B8% (2)
- D88% (21)
Explanation
Manual triggering is available from the Azure Sentinel portal in the following blades: In Incidents view, choose a specific incident, open its Alerts tab, and choose an alert. In Investigation, choose a specific alert. Click on View playbooks for the chosen alert. You will get a list of all playbooks that start with an When an Azure Sentinel Alert is triggered and that you have access to. Click on Run on the line of a specific playbook to trigger it. Select the Runs tab to view a list of all the times any playbook has been run on this alert. It might take a few seconds for any just-completed run to appear in this list. Clicking on a specific run will open the full run log in Logic Apps. https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook#run-a- playbook-on-demand
Topics
Community Discussion
No community discussion yet for this question.