Question 247 of 642 from exam AZ-900: Microsoft Azure Fundamentals

Box: automatically respond to threats

Playbooks are collections of procedures that can be run from Microsoft Sentinel in response to an alert or incident. A playbook can help automate and orchestrate your response, and can be set to run automatically when specific alerts or incidents are generated, by being attached to an analytics rule or an automation rule, respectively.

Note: Automation rules help you triage incidents in Microsoft Sentinel. You can use them to automatically assign incidents to the right personnel, close noisy incidents or known false positives, change their severity, and add tags. They are also the mechanism by which you can run playbooks in response to incidents.

https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook