Govur University Logo
--> --> --> -->
...

In Microsoft Sentinel, when building an automatic response to a threat using a playbook, what is the best way to make sure the playbook keeps working even if a connected system temporarily fails or is slow?



In Microsoft Sentinel, playbooks are built on Azure Logic Apps, which are automated workflows that integrate with various systems to perform security actions. To ensure a playbook keeps working even if a connected system temporarily fails or is slow, the best approach is to implement and configure retry policies for individual actions within the Logic App. A retry policy is a built-in mechanism that reattempts an action if it fails due to a transient error, such as a temporary network issue, an API service being temporarily unavailable, or a system experiencing high load and throttling requests. Transient errors are temporary, self-resolving failures that are likely to succeed on a subsequent attempt after a short delay. By configuring a retry policy, the playbook avoids failing completely due to a momentary disruption, thus increasing its resilience and reliability. When an action in a playbook attempts to connect to an external system and r....

Log in to view the answer



Redundant Elements