Configure Playbook (Logic Apps)
- Shirly Tsang
Analytics
Go to Microsoft Sentinel and select your Workspace.
Click on Automation under Configuration and click on Playbook templates (Preview), search for Infoblox.
Select the playbook you want to install and then click on the Create Playbook button.
In the Basic tab, Select Subscription and Resource group and click on Next : Parameters
NOTE: You can update the Playbook name but we recommend keeping it as default.
In the Parameters tab, provide parameters it asks as there are different parameters for each playbook then click on Next : Connections
In connections click on Next: Review+Create.
Verify the details and click on Create playbook
Make sure you follow the Post Deployment Steps mentioned here before executing the playbook
After creating the playbook, go to API connections
The user needs to Authorize for all the API connections except Microsoft Sentinel. Click on any connection and then click the Authorize button in Edit API connection under General.
After authorizing the connection, user needs to assign role in Log Analytics Workspace
Go to Log Analytics Workspace → <your workspace> → Access Control → Add → Add role assignment.
Under Role select Job function roles and select Microsoft Sentinel Contributor and click Next.
In Members select Managed identity then click + Select members and add your logic app as member
After clicking on Select click on Review + assign and click on Review + assign again
Similarly configure the other playbooks from Playbook templates (Preview)
