rage.fail

azure-siem-automation-rule-playbook-ref

explicit azure emits CanTrigger

match (record)

{ "field": "properties.actions", "resource_type": "Microsoft.SecurityInsights/automationRules" }

where

action.actionType == RunPlaybook action.actionConfiguration.logicAppResourceId is non-empty

emit

source type	`EventRule`
target type	`Workflow`
source	`<Sentinel automation rule (modeled as EventRule — a Messaging subtype)>`
target	`<Logic App playbook (Workflow) at action.actionConfiguration.logicAppResourceId>`

Narrative

Sentinel automation rule {source.name} triggers playbook {target.name} (RunPlaybook action) when its incident/alert trigger conditions are met.

Raw rule rules/explicit/azure/loganalytics.yaml

id: azure-siem-automation-rule-playbook-ref
emits: CanTrigger
applies_to:
- azure
match_record:
  resource_type: Microsoft.SecurityInsights/automationRules
  field: properties.actions
where:
- action.actionType == RunPlaybook
- action.actionConfiguration.logicAppResourceId is non-empty
emit:
  source_type: EventRule
  target_type: Workflow
  source: "<Sentinel automation rule (modeled as EventRule \u2014 a Messaging subtype)>"
  target: <Logic App playbook (Workflow) at action.actionConfiguration.logicAppResourceId>
  api_source: GET /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.OperationalInsights/workspaces/{workspace}/providers/Microsoft.SecurityInsights/automationRules
  evidence_field: actions[*].actionConfiguration.logicAppResourceId
  narrative: Sentinel automation rule {source.name} triggers playbook {target.name} (RunPlaybook action)
    when its incident/alert trigger conditions are met.