Your company is moving all on-premises workloads to Azure and Microsoft 365. You need to design a security orchestration, automation, and response…

The core requirements are automation to minimize manual intervention and the ability to perform a specific response action (posting to Microsoft Teams), which are the defining characteristics of a Security Orchestration, Automation, and Response (SOAR) strategy. In Microsoft Sentinel, SOAR capabilities are implemented using playbooks. Playbooks are automated workflows built on Azure Logic Apps that can be triggered by security alerts. They execute a predefined set of actions, such as creating a ticket, blocking an IP address, or, as required in the scenario, posting a message to a Microsoft Teams channel. This directly addresses both minimizing manual effort and integrating with Teams for notifications.

A. data connectors: These are used exclusively for ingesting data and logs from various sources into Microsoft Sentinel; they do not perform any automated response actions.

C. workbooks: These are interactive visualization tools and dashboards for analyzing and reporting on the data within Microsoft Sentinel, not for orchestrating automated responses.

D. KQL: Kusto Query Language is used to write analytics rules for threat detection and to perform threat hunting queries, but it is not the mechanism for automating the response to a detected threat.

1. Microsoft Azure Documentation

Microsoft Sentinel

"Automate threat response with playbooks in Microsoft Sentinel": "A playbook is a collection of procedures that can be run from Microsoft Sentinel in response to an alert. A playbook can help automate and orchestrate your threat response... Playbooks in Microsoft Sentinel are based on workflows built in Azure Logic Apps". This document explicitly identifies playbooks as the tool for SOAR.

2. Microsoft Azure Documentation

Microsoft Sentinel

"Tutorial: Use playbooks to respond to threats in Microsoft Sentinel": This tutorial provides a step-by-step guide on creating a playbook that

upon receiving an alert

"sends a message to your security operations channel in Microsoft Teams or Slack to make sure your security analysts are aware of the incident." This directly confirms playbooks meet the specific requirement of the question.

3. Microsoft Azure Documentation

Microsoft Sentinel

"Connect data sources": "To onboard Microsoft Sentinel

you first need to connect your data sources." This reference clarifies the singular role of data connectors as an ingestion mechanism

distinct from response automation.

4. Microsoft Azure Documentation

Microsoft Sentinel

"Visualize and monitor your data": "After you connected your data sources to Microsoft Sentinel

you can visualize and monitor the data using the Microsoft Sentinel adoption of Azure Monitor Workbooks". This confirms that workbooks are for visualization

not automation.