azure-defender-automation-action-configuration
Defender automation actions can expose Logic App resource IDs, Event Hub connection targets, and operator-entered text.
Where it sits
| location | Microsoft.Security/automations properties.{sources,actions,scopes,description} |
|---|---|
| location kind | policy_document |
| data kinds | credential webhook_secret sensitive_data |
| emits edge | ContainsSecret |
| service | Defender for Cloud (azure:defender) |
Collection recipe
| access mode | read_api |
|---|---|
| operation | Automations - Get |
| response path | properties |
| encoding | json |
| params | {"resource_id": "\u003cazure-resource-id\u003e"} |
Required permissions
Microsoft.Security/automations/read