What should you do first?

You have an existing Azure logic app that is used to block Azure Active Directory (Azure AD) users. The logic app is triggered manually.

You deploy Azure Sentinel.

You need to use the existing logic app as a playbook in Azure Sentinel.

What should you do first?
A . And a new scheduled query rule.
B. Add a data connector to Azure Sentinel.
C. Configure a custom Threat Intelligence connector in Azure Sentinel.
D. Modify the trigger in the logic app.

View Answer

Answer: D

Explanation:

https://docs.microsoft.com/en-us/azure/sentinel/playbook-triggers-actions

https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook