2 docs tagged with "soar"

How Sentinel automation rules evaluate triggers, conditions and actions in order, how Logic Apps playbooks authenticate with a managed identity and which roles they need, common response patterns such as MDE isolate and Entra disable, the automation health log, the permissions model, cost, and what still works in the Defender portal.

Microsoft Sentinel as SIEM and SOAR on a Log Analytics workspace, its components, the analytics and data lake tiers, pricing and the E5 data grant, the Defender portal as the only home after March 2027, and how to decide on one workspace or many.