2 docs tagged with "automation"

How Sentinel automation rules evaluate triggers, conditions and actions in order, how Logic Apps playbooks authenticate with a managed identity and which roles they need, common response patterns such as MDE isolate and Entra disable, the automation health log, the permissions model, cost, and what still works in the Defender portal.

How Defender for Cloud alerts are built, scored and retired, what suppression and email notifications do, how workflow automation and continuous export move alerts out of the portal, and how the Sentinel connector and the Defender XDR integration fit together without creating duplicate incidents.