Microsoft Sentinel has generated a high-priority incident. Your team is investigating and needs to automatically isolate a compromised VM from the network as soon as an incident with the tag 'VM Compromise' is created. Which Sentinel feature enables this automated response?

Question

Sunny · Accepted Answer

Create a Sentinel automation rule that triggers a Logic App playbook to apply an NSG deny-all rule on incident creation. Sentinel automation rules can trigger Logic App playbooks (SOAR) automatically when incidents are created, updated, or closed. A playbook can call the Azure REST API to apply a deny-all NSG to the compromised VM's NIC, effectively isolating it from the network. This is the standard SOAR pattern in Sentinel for automated incident response.

Microsoft Sentinel has generated a high-priority incident. Your team is investigating and needs to automatically isolate a compromised VM from the network as soon as an incident with the tag 'VM Compromise' is created. Which Sentinel feature enables this automated response?

Microsoft Sentinel has generated a high-priority incident. Your team is investigating and needs to automatically isolate a compromised VM from the network as soon as an incident with the tag 'VM Compromise' is created. Which Sentinel feature enables this automated response?

📚 What This Question Tests

More Microsoft Sentinel Practice Questions