Author: Gabriel Wolf
A collection of production-grade, context-aware Security Orchestration, Automation, and Response (SOAR) playbooks built using Azure Logic Apps and integrated with Microsoft Sentinel and Microsoft Defender for Endpoint (MDE).
Note
These templates are provided as anonymized reference implementations, not one-click marketplace-style deployments. The goal of this repository is to share the architecture, workflow logic, and implementation patterns behind the automation—not to provide a guaranteed plug-and-play deployment for every environment.
- Primary Function: Automated endpoint containment utilizing the Microsoft Defender for Endpoint (MDE) API.
- Key Features:
- Pre-containment state evaluation checking to prevent unnecessary disruptions.
- Automatic system classification loops separating standard workstations from mission-critical servers.
- An asynchronous verification engine polling the MDE machine actions API every 60 seconds to guarantee confirmation of isolation.
- Integrated Azure OpenAI (
gpt-4o-mini) agent block generating briefs for SOC analysts with Enterprise Data Protection (EDP).
- Primary Function: Automated user profile lookup via Microsoft Graph and identity containment via a custom corporate Identity API.
- Key Features:
- Dynamic active-hours logic parsing (for SOC on-call).
- Automated VIP/Executive Identity protection bypass loops targeting high-profile roles to mitigate critical business downtime risks.
- Native ITSM ticketing integration for rapid service-desk handoffs.
Before deploying any templates to a live production tenant, you can discover your environment configurations and run pre-flight local syntax validation checks using our Azure Deployment & Validation Helper Guide.
This repository is licensed under the MIT License — meaning the frameworks are free to adapt, modify, and build upon with zero warranty or liability implied.