skills.rest
jay-steenbergen
jay-steenbergenCOMMUNITY
Explore all skills by this author →
GitHub

cso-soar-playbook

Builds a Logic App playbook that auto-disables users from Sentinel incidents via Microsoft Graph.

2|Updated Jun 1, 2026
Search Tags:#incident response#microsoft graph#managed identity#sentinel#soar#logic apps#automation rule
One-click install
npx skills add https://github.com/jay-steenbergen/MSSAMentorAgent --skill cso-soar-playbook-jay-steenbergen
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cso-soar-playbook
Source: https://github.com/jay-steenbergen/MSSAMentorAgent/tree/main/.github/skills/tracks/cybersecurity-ops/cso-soar-playbook
Command: npx skills add https://github.com/jay-steenbergen/MSSAMentorAgent --skill cso-soar-playbook-jay-steenbergen

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security operations teams need automated incident response, but wiring a SOAR pipeline end-to-end (detection to action to audit trail) involves many moving parts across Sentinel, Logic Apps, managed identities, and Microsoft Graph. This Skill guides a learner through building a complete auto-response playbook step by step. ## Core Features & Use Cases - Logic App Playbook Construction: Create a Logic App with a Sentinel incident trigger, account entity parsing, a Graph API PATCH call to disable a user, and a comment-back action for audit. - Managed Identity & Permissions Setup: Assign a system-managed identity and grant it the User.ReadWrite.All Graph application permission via appRoleAssignments. - Automation Rule Wiring & Verification: Connect the playbook to a Sentinel automation rule triggered by impossible-travel incidents, then run an end-to-end test with a disposable test user. - Use Case: A cybersecurity learner triggers an impossible-travel detection with VPN-switched sign-ins, watches Sentinel create the incident, and observes the playbook automatically disable the test user and post a result comment. ## Quick Start Ask the mentor to start the cso-soar-playbook project and walk you through building a Logic App that disables a user when a Sentinel impossible-travel incident fires.

Frequently Asked Questions about cso-soar-playbook

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I build a Sentinel SOAR playbook with Logic Apps?▼

Create a Logic App with the Microsoft Sentinel incident trigger, add an Entities - Get Accounts action, loop over accounts, call the Microsoft Graph PATCH /users/{id} endpoint with accountEnabled set to false, then add a comment back to the incident. Wire it to an automation rule that runs on your target detection.

How do I grant Microsoft Graph permissions to a Logic App managed identity?▼

Enable a system-assigned managed identity on the Logic App, then grant the User.ReadWrite.All application role by posting an appRoleAssignment to the Graph servicePrincipals endpoint. This requires Global Admin or Privileged Role Admin rights to consent.

Why does my Logic App Graph call return 401 or 403 errors?▼

A 401 means the managed identity was not granted admin-consented Graph permissions, so re-run the appRoleAssignment. A 403 means the granted permission is too narrow, such as User.Read.All instead of the required User.ReadWrite.All.

What is the difference between a Sentinel automation rule and a playbook?▼

An automation rule is the orchestrator that watches for incident conditions and triggers actions in a defined order. A playbook is the Logic App workflow that performs the actual response steps, such as disabling a user and commenting on the incident.

Should I auto-disable users without human approval in production?▼

Not initially. Insert a Send approval email Logic Apps action before the Graph call so a human approves the disable step. Also add an exception list for critical accounts and alerting when the playbook fails before full production rollout.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

building-cloud-siem-with-sentinel

Deploy Microsoft Sentinel with KQL detection rules and SOAR playbooks for multi-cloud security operations.

Community
Advanced
NCLGISANCLGISA

microsoft-defender

Manage Microsoft Defender XDR, Endpoint, and Sentinel security operations.

Official
Advanced
FunnyWolfFunnyWolf
1.1k

asp-playbook-zh

Manage ASP playbook definitions and run histories via the MCP server.

Community
Advanced
abzhawabzhaw

incident-response

Apply a 7-step incident lifecycle to remediate Julia's sentinel security findings.

Community
Advanced