주요 콘텐츠로 건너뛰기

Automate Response to Alerts

Implementation Effort: Medium
Customer IT and Security Operations teams must configure workflow automation using Logic Apps, ARM templates, or Bicep to respond to specific security alerts.

User Impact: Low
All actions are performed by administrators and security teams; no user-facing changes or notifications are required.

Overview​

Automating responses to alerts in Microsoft Defender for Databases helps reduce response time and ensures consistent handling of threats. Microsoft Defender for Cloud supports workflow automation that can trigger Logic Apps based on specific alert types, enabling actions like sending notifications, isolating resources, or opening tickets.

Key Capabilities​

  1. Enable Workflow Automation

    • Go to Microsoft Defender for Cloud > Automation.
    • Create a new automation rule that defines:
      • Trigger conditions (e.g., alert severity, alert type)
      • Scope (e.g., subscription or resource group)
      • Action (e.g., trigger a Logic App) 1.

  2. Use Logic Apps for Response

    • Logic Apps can perform actions such as:
      • Sending email or Teams notifications
      • Creating incidents in ticketing systems
      • Disabling user accounts or isolating VMs
    • You can deploy Logic Apps using ARM templates or Bicep files 2.

  3. Deploy via ARM Template or Bicep

    • Use predefined templates to deploy automation workflows.
    • Templates define the automation name, scope, Logic App details, and alert settings 2.

  4. Test and Monitor

    • Simulate alerts to verify that the automation triggers correctly.
    • Monitor execution logs in the Logic App designer or Azure Monitor.

  5. Best Practices

    • Start with non-disruptive actions (e.g., notifications) before automating containment.
    • Regularly review automation rules to ensure they align with evolving threats and policies.

This capability supports the Zero Trust principle of "Assume Breach" by enabling rapid, consistent, and scalable responses to database threats. Without automation, response delays or human error may increase the risk of data compromise.

Reference​