Sentinel automation rules and playbooks

SC-200 · Manage incident response · Updated

Decide between automation rules and playbooks, pick the right trigger, and set up permissions so Sentinel can respond automatically.

This lesson is part of full SC-200 access

The first 2 SC-200 lessons are free. Full access opens every lesson with its practice questions, and the exam-style SC-200 question bank.

In this lesson
  • Automation rules versus playbooks
  • Triggers
  • Permissions
  • Typical patterns
  • Exam traps
  • Practice questions

Get full access Try the free practice exam Log in

SC-200 course outline

All 9 lessons · Course overview
  1. Microsoft Sentinel workspaces, roles and data connectorsManage a security operations environment Free
  2. Defender for Endpoint onboarding, device groups and rolesManage a security operations environment Free
  3. Defender for Cloud plans, servers and security postureConfigure protections and detections Full access
  4. Sentinel analytics rules, UEBA and threat intelligenceConfigure protections and detections Full access
  5. Defender XDR custom detections and alert tuningConfigure protections and detections Full access
  6. Sentinel automation rules and playbooksManage incident response Full access
  7. Investigating incidents and responding on devicesManage incident response Full access
  8. KQL essentials for threat huntingPerform threat hunting Full access
  9. Hunting tools in Sentinel and Defender XDRPerform threat hunting Full access