Home
The Microsoft Sentinel Triage AssistanT (STAT) is a Logic Apps Custom Connector that calls on an Azure Function app with a library of Automation Modules that can be used from Incident or Alert based Microsoft Sentinel playbooks. The connector and modules simplify automation by moving complex automation tasks into these callable modules so they can be performed consistently and with ease from the Logic Apps Connector.
Using the Microsoft Sentinel Triage AssistanT starts by calling the Base Module. This module prepares and enriches Incident and entity data for each of the triage modules which consumes this data. Once the Base Module has been called the triage modules can be used to perform analysis against the entities related to the Microsoft Sentinel incident or alert. These triage modules will return an easy to use, well documented result so you can evaluate the outputs and quickly make decisions about how to handle an incident or alert.
Project goals include:
- Reducing the time (and cost) of building Microsoft Sentinel Automation
- Reducing the time to test Microsoft Sentinel Automation through the use of consistent callable modules
- Increasing SOC efficiency by triaging Incidents before they reach an analyst
Many of the Microsoft Sentinel playbook templates available today focus on Notification, Incident Enrichment and Remediation. This project focuses on the triage and analysis of incidents and alerts to provide additional confidence in the quality before taking actions. When an incident or alert is determined to be low quality (likely a benign positive), it can be closed or lowered in severity through these automation flows. When an incident or alert is determined to be of high quality, it can be raised in severity, assigned to an analyst or even trigger a remediation task.
The full solution is available for deployment in the Deployment section and module specific documentation can be found in the Modules.
If you have any questions about this project or would like to provide suggestions to the STAT project maintainers, please open an issue or a discussion.
The Sentinel Triage AssistanT consists of 3 components
- Sentinel Playbook (Logic App)
- Logic Apps Custom Connector
- STAT Function
When a Sentinel incident is created that requires triage, a Sentinel Playbook will be started using an automation rule. This playbook will start with a Sentinel Incident trigger and be used to call the Sentinel Triage AssistanT through the Logic Apps Custom Connector. Once the triage information is received from STAT, this Playbook can then determine the outcome of the incident.
Here is a high-level view of the information flow using STAT:
The Logic Apps Custom Connector (STAT Connector) serves as the user interface of STAT. All automations built on the STAT platform will use this custom connector to retrieve relevant information about the incident or alert and return that information into the Sentinel Playbook for a determination to be made. The STAT Connector works in a similar way to built-in Logic App connectors so if you already have experience with Logic Apps this will be a familiar interface.
Today a series of 13 modules have been released for STAT. These modules also operate behind the scenes, but it is important to understand their capabilities to make the best use of the solution. Each module is responsible for getting specific insights into the entities associated with the incident or alert and returning those insights in an easy-to-use format back to the STAT Connector.
When using STAT, the first module you should call from the STAT Connector is the Base Module. The Base Module performs some enrichment activities to prepare the incident data for the rest of the STAT solution. All other modules will require inputs from this Base module so they should be called after the Base Module has processed the incident data.
An example of the use of multiple modules can be found in the Sample playbook included during the deployment.