KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#dsh #dsh-plugin #typescript #developer-tools #claude-code #ai-agent #codex #deepseek-harness #ai-agents #cli #react #mcp

SentinelAutomationModules

★ 288 Open GitHub ↗

The Microsoft Sentinel Triage AssistanT (STAT) enables easy to create incident triage automation in Microsoft Sentinel

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Microsoft Sentinel Triage AssistanT (STAT) :hospital:

The Microsoft Sentinel Triage AssistanT (STAT) is a Logic Apps Custom Connector that calls on a library of Automation [Modules](https://github.com/briandelmsft/SentinelAutomationModules/wiki/Modules) that can be used from Incident and alert based Microsoft Sentinel playbooks.  This connector and modules simplify automation by moving complex automation tasks into these callable modules so they can be performed consistently and with ease from the Logic Apps Connector.

Using the Microsoft Sentinel Triage AssistanT starts by calling the Base Module.  This module prepares and enriches Incident and entity data for each of the triage modules which consumes this data.  Once the Base Module has been called the triage modules can be used to perform analysis against the entities related to the Microsoft Sentinel incident.  These triage modules will return an easy to use, well documented result so you can evaluate the outputs and quickly make decisions about how to handle an incident.

Project goals include:

* Reducing the time (and cost) of building Microsoft Sentinel Automation
* Reducing the time to test Microsoft Sentinel Automation through the use of consistent callable modules
* Increasing SOC efficiency by triaging Incidents before they reach an analyst

Many of the Microsoft Sentinel playbook templates available today focus on Notification, Incident Enrichment and Remediation.  This project focuses on the triage and analysis of an incident to provide additional confidence in the quality of the incident before taking actions.  When the incident is determined to be low quality (likely a benign positive), it can be closed or lowered in severity through these automation flows.  When the incident is determined to be of higher quality, it can be raised in severity, assigned to an analyst or even trigger a remediation playbook.

Documentation for STAT can be found in the [Wiki](https://github.com/briandelmsft/SentinelAutomationModules/wiki).  Deployment information is also availble on the [deployment page](https://github.com/briandelmsft/SentinelAutomationModules/wiki/Deployment).

If you have any questions about this project or would like to provide suggestions to the STAT project maintainers please open an [issue](https://github.com/briandelmsft/SentinelAutomationModules/issues/new/choose) or a [discussion](https://github.com/briandelmsft/SentinelAutomationModules/discussions).

SentinelAutomationModules

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README