IntegratedSOC
Menu

Automation

Automate the work you already understand

Three fictional stories: a response, a report and a reviewed change.

Drawn on Microsoft 365 E5

Automation pays off when it repeats a decision the team has already made many times. This page covers what Microsoft lists for ISOC automation, three short scenarios, and the checks to run before a workflow acts without a person.

The three scenarios are fictional and the people in them are invented. Each has a 4-step demo: play it (about 16 to 17 seconds of animation, not the time the real work takes) or step through it. With reduced motion on, a demo moves only when you choose the next step.

The three products these scenarios use, in their places on the wheel. Open the wheel
Reading the diagrams
  • Person
  • Resource
  • Signal or evidence
  • Product or service
  • Action
  • The step being shown
  • Native evidence
  • Other connection
  • Configured ingestion
  • Permitted action

From Microsoft

What ISOC adds to the Defender portalWhat ISOC lists without a workspace

Microsoft lists these among the capabilities ISOC adds.Microsoft describes these ISOC capabilities as available to eligible customers before any ISOC workspace is created.

  • Case management
  • Natural-language playbook generation
  • Enhanced automation rules
  • Workbooks

SourceISOC overview on Microsoft Learn (opens in a new tab)

About the portfolio wheel

Choosing a license here shows what the license includes. It does not turn on ISOC or configure anything in your tenant.

Open the wheel

SOARAutomation

Turn a reviewed action into a workflow

Alex configures a repeatable response to the invoice scenario.

Lit: ISOC, SOAR, Mailboxes, Inbox, Hunting.ISOC uses Automation and Incidents and hunting. Context only, with no route into ISOC here: Exchange and Outlook. Incidents and hunting come with Defender XDR.Lit: Mailboxes, Inbox.Context only, with no route into ISOC here: Exchange and Outlook.Lit: SOAR, Mailboxes, Inbox.Lit: Automation. Context only, with no route into ISOC here: Exchange and Outlook.Lit: ISOC, SOAR, Mailboxes, Inbox.ISOC uses Automation. Context only, with no route into ISOC here: Exchange and Outlook.Lit: Hunting, ISOC, SOAR, Mailboxes, Inbox.ISOC uses Automation and Incidents and hunting. Context only, with no route into ISOC here: Exchange and Outlook. Incidents and hunting come with Defender XDR.

Every part this story uses

Play the story, or choose a step.

Trigger

A trigger condition matches the invoice incident.A configured condition identifies the intended incident.

Author

The rule or playbook defines its response workflow.The rule or playbook defines its response workflow.

Validate

The team reviews, tests and activates the workflow.The team reviews, tests and activates the workflow.

Execute

The activated workflow carries out its response action.Configured credentials and permissions limit the supported action.

4 stepsReady

  1. A trigger condition matches the invoice incident.A configured condition identifies the intended incident.

  2. The rule or playbook defines its response workflow.The rule or playbook defines its response workflow.

  3. The team reviews, tests and activates the workflow.The team reviews, tests and activates the workflow.

  4. The activated workflow carries out its response action.Configured credentials and permissions limit the supported action.

The steps as a diagram

Trigger. A trigger condition matches the invoice incident.A configured condition identifies the intended incident.

Author. The rule or playbook defines its response workflow.The rule or playbook defines its response workflow.

Validate. The team reviews, tests and activates the workflow.The team reviews, tests and activates the workflow.

Permitted action

Execute. The activated workflow carries out its response action.Configured credentials and permissions limit the supported action.

Permitted action

What to rememberWhat to remember, what it takes, sources
What to remember
A reviewed response becomes a repeatable workflow.Authoring a workflow does not activate its response.
What it takes
Eligible ISOC preview tenants can use enhanced rules and generate playbooks without an ISOC workspace. Third-party Log Analytics data needs a Sentinel workspace (in the ISOC preview, an ISOC workspace). Configure integrations, credentials and action permissions. Review, test and activate generated code. Existing Sentinel playbooks built on Logic Apps have their own Azure consumption.
Status and sources
ISOC automation preview; existing Sentinel rules separate
Open SOARAutomation on the wheel Next: ReportsWorkbooks

ReportsWorkbooks

Make the investigation visible

Alex turns available investigation results into a shared view.

Lit: ISOC, Reports, Email, Endpoint, Hunting.Lit: Defender for Office 365 and Defender for Endpoint into ISOC. ISOC uses Workbooks and Incidents and hunting. Incidents and hunting come with Defender XDR.Lit: Email, Endpoint.Lit: Defender for Office 365 and Defender for Endpoint.Lit: Reports, Email, Endpoint.Lit: Defender for Office 365, Defender for Endpoint and Workbooks.Lit: ISOC, Reports, Email, Endpoint.Lit: Defender for Office 365 and Defender for Endpoint into ISOC. ISOC uses Workbooks.Lit: Hunting, ISOC, Reports, Email, Endpoint.Lit: Defender for Office 365 and Defender for Endpoint into ISOC. ISOC uses Workbooks and Incidents and hunting. Incidents and hunting come with Defender XDR.

Every part this story uses

Play the story, or choose a step.

Question

Alex asks how the fictional events align over time.Alex asks how the fictional events align over time.

Query

The workbook queries the investigation data.The workbook queries a supported, permitted data route.

Visualize

Results become a timeline or chart.Results become a timeline or chart.

Share

The next analyst sees the investigation context.The next analyst sees the investigation’s available context.

4 stepsReady

  1. Alex asks how the fictional events align over time.Alex asks how the fictional events align over time.

  2. The workbook queries the investigation data.The workbook queries a supported, permitted data route.

  3. Results become a timeline or chart.Results become a timeline or chart.

  4. The next analyst sees the investigation context.The next analyst sees the investigation’s available context.

The steps as a diagram

Question. Alex asks how the fictional events align over time.Alex asks how the fictional events align over time.

Query. The workbook queries the investigation data.The workbook queries a supported, permitted data route.

Permitted action

Visualize. Results become a timeline or chart.Results become a timeline or chart.

Query result

Share. The next analyst sees the investigation context.The next analyst sees the investigation’s available context.

What to rememberWhat to remember, what it takes, sources
What to remember
The next analyst sees the investigation as a timeline.Preview hunting workbooks and workspace workbooks have different requirements.
What it takes
Eligible ISOC preview tenants can use Defender advanced-hunting workbooks without an ISOC workspace. Workbook permissions and access to queried workloads are required. Existing Sentinel workbooks require workspace data and Azure permissions.
Status and sources
ISOC workbooks preview; existing Sentinel workbooks separate
Open ReportsWorkbooks on the wheel Next: APIsDev tools

APIsDev tools

Ship a reviewed detection change

Priya moves reviewed security content through a configured repository.

Lit: ISOC, APIs, Hunting, SIEM.ISOC uses Developer tools and Sentinel. Context only, with no route into ISOC here: Incidents and hunting. Sentinel is a separate Azure plan, drawn gold dashed. Incidents and hunting come with Defender XDR. Sentinel runs on its own workspace and usage.Lit: Hunting.Context only, with no route into ISOC here: Incidents and hunting. Incidents and hunting come with Defender XDR.Lit: APIs, Hunting.Lit: Developer tools. Context only, with no route into ISOC here: Incidents and hunting. Incidents and hunting come with Defender XDR.Lit: ISOC, APIs, Hunting.ISOC uses Developer tools. Context only, with no route into ISOC here: Incidents and hunting. Incidents and hunting come with Defender XDR.Lit: SIEM, ISOC, APIs, Hunting.ISOC uses Developer tools and Sentinel. Context only, with no route into ISOC here: Incidents and hunting. Sentinel is a separate Azure plan, drawn gold dashed. Incidents and hunting come with Defender XDR. Sentinel runs on its own workspace and usage.

Every part this story uses

Play the story, or choose a step.

Improve

Priya proposes a detection improvement from Alex’s investigation.Priya proposes a detection improvement from Alex’s investigation.

Review

The team reviews the security content change.The team reviews the security content change.

Deploy

The repository connection deploys the reviewed change.A configured repository connection runs its deployment workflow.

Verify

The team checks the deployed content in the workspace.The team checks deployed content in the permitted workspace.

4 stepsReady

  1. Priya proposes a detection improvement from Alex’s investigation.Priya proposes a detection improvement from Alex’s investigation.

  2. The team reviews the security content change.The team reviews the security content change.

  3. The repository connection deploys the reviewed change.A configured repository connection runs its deployment workflow.

  4. The team checks the deployed content in the workspace.The team checks deployed content in the permitted workspace.

The steps as a diagram

Improve. Priya proposes a detection improvement from Alex’s investigation.Priya proposes a detection improvement from Alex’s investigation.

Review. The team reviews the security content change.The team reviews the security content change.

Deploy. The repository connection deploys the reviewed change.A configured repository connection runs its deployment workflow.

Permitted action

Verify. The team checks the deployed content in the workspace.The team checks deployed content in the permitted workspace.

Permitted action

What to rememberWhat to remember, what it takes, sources
What to remember
A reviewed detection change reaches the workspace.ISOC repositories need a workspace and repository permissions.
What it takes
APIs require authentication and roles. ISOC preview CI/CD requires an ISOC workspace and repository permissions. Data-lake notebooks have separate onboarding, runtime and compute requirements. Feature availability and capacity must be checked.
Status and sources
ISOC repositories preview; other tools retain their own requirements
Open APIsDev tools on the wheel

Common practice

Before a workflow acts on its own

These checks come from common security operations practice rather than from a Microsoft requirement. They keep a useful workflow from becoming a new source of incidents.

  1. Start with a task the team already does by hand and understands well, such as tagging, assigning or enriching an incident.
  2. Name an owner for each workflow, decide who approves changes to it, and write down how to turn it off.
  3. Run it against recent incidents in a test setting before it touches live cases.
  4. Keep a person in the loop for actions that are hard to undo, such as disabling an account, isolating a device or deleting email.
  5. Give the identity that runs the workflow only the permissions the workflow needs.
  6. Review the run history every week for the first month and look for anything that surprised the team.

Limited public preview · invitation-only

Agents that investigate with you

Project Perception is a separate limited public preview of coordinated red, blue and green team agents, available to a small invitation-only group of customers. ISOC eligibility does not grant access to it.

Read more about Project Perception

Automation rules and playbooks sit in Security operations, at the top of the wheel. Select them to see what each needs.

Open automation on the wheel