When Microsoft Defender for Cloud detects a security threat, you need to respond quickly. Azure Logic Apps can automate notifications to the security team or create investigation tickets.
In this article, I’ll show you how to set up a workflow that sends a Microsoft Teams notification when Defender for Cloud detects a high-severity alert.
Send a Teams notification for a security alert
Below, I will describe the prerequisites and steps to send a Teams notification for a security alert on one of your Azure VMs using workflow automation.
Prerequisites
- An Azure subscription with Microsoft Defender for Cloud enabled,
- a Consumption plan Azure Logic App,
- and a Microsoft Teams account with permission to post messages to the target team or channel.
The Logic App (Auto-MS-Defender-for-Cloud-Alerts)
To create a new workflow automation, you need a Logic App on the Consumption plan. For my article demo, I have created a simple Logic App with a trigger and an action. I used the OOB trigger “When a Microsoft Defender for Cloud alert is created or triggered,” and one action:l, “Post message in a chat or channel ” to post a message to a Teams channel so an admin can be alerted immediately.
The Wokflow Automation
This is the second step. In this step, I will show you how to create the workflow automation in the Microsoft Defender for Cloud service. To do so, follow the steps below:
Open Microsoft Defender for Cloud, navigate to Management –> Workflow automation, and select + Add workflow automation from the top menu.
In the General section, enter a Name, add a description (I didn’t :)), and select the Resource group where you created the Logic App.
In the Trigger conditions section, select the Defender for Cloud data type, such as Security alert. Then, enter the word(s) contained in the Alert name and choose the Severity Alert.
In the Actions section, select your Azure subscription and then choose your Logic App. If you cannot see the Logic App, click Refresh and try again. Bear in mind, your logic includes at least the trigger and is created under the correct plan.
Test the workflow automation
To test the workflow automation via the Microsoft Defender for Cloud you can generate Sample alerts and trigger the Logic App.
To do so, open Microsoft Defender for Cloud, navigate to General -> Security alerts, tap the Sample alerts button in the top menu, select the Virtual Machines service under Defender for Cloud plans, and tap the Create sample alerts button.
A few seconds later, the security alert’s main dashboard will appear, as shown in the image below, and the flow may have been activated.
A few seconds later, the channel where you will post the alert will look like the one below:
What else can you automate?
Using Microsoft Defender for Cloud with Azure Logic Apps helps reduce manual work, speeds up responses, and keeps security operations consistent.