Sentinel - Automation Rules and Playbook activitites

Sentinel Automation Rules Playbooks

Query

SentinelHealth 
| where TimeGenerated > ago(90d)
| where SentinelResourceType == "Automation rule"
| mv-expand TriggeredPlaybooks = ExtendedProperties.TriggeredPlaybooks
| extend runId = tostring(TriggeredPlaybooks.RunId)
| join (AzureDiagnostics 
    | where OperationName == "Microsoft.Logic/workflows/workflowRunCompleted"
    | project
        resource_runId_s,
        playbookName = resource_workflowName_s,
        playbookRunStatus = status_s)
    on $left.runId == $right.resource_runId_s
| project
    RecordId,
    TimeGenerated,
    AutomationRuleName= SentinelResourceName,
    AutomationRuleStatus = Status,
    Description,
    workflowRunId = runId,
    playbookName,
    playbookRunStatus

About this query

Sentinel - Automation Rules and Playbook activitites

Query Information

Description

Use the below queries to gain insights into Sentinel Automation Rule and Playbook activities

References

Monitor the health of your automation rules and playbooks

Microsoft Sentinel

SentinelHealth
| where OperationName == "Playbook was triggered"

SentinelHealth
| where OperationName == "Automation rule run"

SentinelHealth
| where OperationName == "Automation rule run"

Explanation

The query is used to gain insights into Sentinel Automation Rule and Playbook activities. It retrieves information about the health and status of automation rules and playbooks, including the record ID, time generated, automation rule name, automation rule status, description, workflow run ID, playbook name, and playbook run status. There are also additional queries to specifically filter for triggered playbooks and automation rule runs.

Details

Alex Verboon

Released: September 18, 2023

Tables

SentinelHealth

Keywords

SentinelHealthTimeGeneratedSentinelResourceTypeAutomation ruleTriggeredPlaybooksExtendedPropertiesrunIdAzureDiagnosticsOperationNameMicrosoft.Logic/workflows/workflowRunCompletedresource_runId_splaybookNameplaybookRunStatusRecordIdAutomationRuleNameAutomationRuleStatusDescriptionworkflowRunId

Operators

whereagomv-expandextendjoinonproject

Actions

GitHub

KQL Search