Pinned Repositories
AS-Add-Machine-Logon-Users-to-Incident
Add Microsoft Defender machine logon users to a Microsoft Sentinel incident comment
AS-Create-Opsgenie-Incident
Create an incident in Opsgenie with the information from a Microsoft Sentinel incident
AS-Import-AD-Group-Users-to-MS-Watchlist
This playbook is intended to be run on a schedule. It will add the users from a specified Azure Active Directory group to a Microsoft Sentinel watchlist.
AS-IP-Blocklist
Add IPs from Microsoft Sentinel Incidents to a Conditional Access Named Locations list
AS-Make-GitHub-Repository-Private
Look up the GitHub repositories associated with the Incident Account Entities and make them private
AS-PagerDuty-Integration
Integrates Microsoft Sentinel with PagerDuty
AS-Revoke-Azure-AD-User-Session-From-Incident
Revoke Entra ID user sessions from Microsoft Sentinel incidents
Azure-Sentinel
Cloud-native SIEM for intelligent security analytics for your entire enterprise.
Defender
Sentinel-Parsers
Accelerynt's Repositories
Accelerynt-Security/AS-Add-Machine-Logon-Users-to-Incident
Add Microsoft Defender machine logon users to a Microsoft Sentinel incident comment
Accelerynt-Security/AS-Revoke-Azure-AD-User-Session-From-Incident
Revoke Entra ID user sessions from Microsoft Sentinel incidents
Accelerynt-Security/Azure-Sentinel
Cloud-native SIEM for intelligent security analytics for your entire enterprise.
Accelerynt-Security/AS-Azure-AD-Group
Add accounts from Microsoft Sentinel incidents to an Azure AD Group
Accelerynt-Security/AS-Make-GitHub-Repository-Private
Look up the GitHub repositories associated with the Incident Account Entities and make them private
Accelerynt-Security/AS-Blob-Storage-Add-Domains-to-Zscaler-URL-Category
Maintain the values of a Zscaler URL category with Azure blob storage
Accelerynt-Security/AS-IAM-Entra-ID-Master-Playbook
Run two identity access management playbooks at once from a Microsoft Sentinel incident
Accelerynt-Security/AS-IAM-Master-Playbook
Run four identity access management playbooks at once from a Microsoft Sentinel incident
Accelerynt-Security/Zscaler-add-Domains-to-URL-Category
Extract domains from Microsoft Sentinel incidents and add them to a Zscaler custom URL category
Accelerynt-Security/Sentinel-Parsers
Accelerynt-Security/AS-Add-Azure-AD-User-Job-Title-to-Incident
Look up the Azure AD user accounts associated with the entities from Microsoft Sentinel incidents and add the Azure AD job titles in an Incident comment
Accelerynt-Security/AS-Armis-Integration
Integrates Microsoft Sentinel with Armis
Accelerynt-Security/AS-Block-GitHub-User
Block GitHub users from Microsoft Sentinel incidents
Accelerynt-Security/AS-Block-Hash-in-Defender
Block File Hashes found in Microsoft Sentinel Incidents in Defender
Accelerynt-Security/AS-Clear-Okta-Network-Zone-List
Clear out all but one of the IPs from an Okta Network Zone list
Accelerynt-Security/AS-Delete-App-Registration
Delete app registrations from Microsoft Sentinel incidents
Accelerynt-Security/AS-Disable-Azure-AD-User-From-Entity
Disable Azure AD user accounts from Microsoft Sentinel account entities
Accelerynt-Security/AS-Edgescan-Integration
Pull Edgescan assets, hosts, and vulnerabilities into Microsoft Sentinel custom logs
Accelerynt-Security/AS-Enable-Azure-AD-User-From-Entity
Enable Azure AD user accounts from Microsoft Sentinel account entities
Accelerynt-Security/AS-Incident-IP-Matched-on-Watchlist
Match Sentinel incident IPs with subnet values in a watchlist and add those matches in incident comments
Accelerynt-Security/AS-Incident-Response-Approval-Email
Facilitate incident response by sending an approval email to the manager(s) of the user(s) associated with a Microsoft Sentinel incident
Accelerynt-Security/AS-IP-Blocklist-Remove-IPs
Accelerynt-Security/AS-MDE-Isolate-Machine
Accelerynt-Security/AS-MDE-Unisolate-Machine
Accelerynt-Security/AS-Recurring-Host-Entity
Search Microsoft Sentinel Incident hosts in Sentinel SecurityAlert logs for other entities containing the same hosts
Accelerynt-Security/AS-Remove-Domains-from-Zscaler-URL-Category
Extract domains from Microsoft Sentinel incidents and remove them from a Zscaler custom URL category
Accelerynt-Security/AS-Revoke-Azure-AD-User-Session-From-Entity
Revoke Entra ID user sessions from Microsoft Sentinel entities
Accelerynt-Security/AS-Sign-Out-Google-User
Sign out Google users from Microsoft Sentinel incidents
Accelerynt-Security/AS-Terminate-Okta-User-Session-From-Entity
Terminate an Okta user's session from a Microsoft Sentinel Entity
Accelerynt-Security/AS-Update-Okta-Network-Zone-From-Entity
Add IPs from Microsoft Sentinel Entities to an Okta Network Zone Blocklist