A Microsoft Sentinel workspace receives alerts from Microsoft Defender for AI about anomalous usage of an Azure OpenAI endpoint. A security engineer wants to automate the response by adding the source IP to a watchlist for 24 hours. Which Microsoft Sentinel feature should be used to automate this response?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you’d use a Microsoft Sentinel SOAR Playbook built on Azure Logic Apps because it can trigger on the Defender for AI alert and call Sentinel connectors to add the source IP to a watchlist for 24 hours. Analytics rules can kick off playbooks, but they don’t directly edit watchlists.
Full Explanation
The correct choice is a Microsoft Sentinel SOAR Playbook built on Azure Logic Apps because it can be triggered by Sentinel alerts or incidents and can perform automated actions, including adding entries to Sentinel watchlists via the Sentinel API connector for the required 24-hour duration. The analytics rule with an automated response action is incorrect because Sentinel analytics rules detect and create incidents but do not directly modify watchlists; the automated response action in analytics rules triggers playbooks. The workbook with auto-refresh and an IP block action is incorrect because Sentinel Workbooks are visualization and reporting tools and cannot perform automated response actions. The Threat Intelligence indicator import is incorrect because it adds indicators of compromise to the Threat Intelligence table for detection, not a response action triggered by specific alerts.