search

briandelmsft / SentinelAutomationModules

The Microsoft Sentinel Triage AssistanT (STAT) enables easy to create incident triage automation in Microsoft Sentinel
MIT License
212 stars 58 forks source link

[Feature] Add Incidient Tasks Support - OOF Module #367

Closed briandelmsft closed 1 year ago

briandelmsft commented 1 year ago

Add incident tasks support to module

piaudonn commented 1 year ago

I maybe that can just actually add a task when there is a user OOF? I am unsure how valuable would it be vs just a comment.

briandelmsft commented 1 year ago

@piaudonn to me the value of the task is it draws more attention that action is required and a status on whether that action has been taken whereas a comment you don't really know if it was looked at.

That said I added items for each module to track... If we choose not to implement for some modules I think that's fine and we can close as not planned.

For this module I think the main use would be of a user is oof you create a task to review the oof message.

The other modules that I'm not sure really need tasks are the run playbook and scoring. For run playbook I expect if you want a task you'll have the other playbook create it as it will have more context. For scoring I don't know if it makes sense until you know what the score is.

briandelmsft commented 1 year ago

@piaudonn so do you think it's worth it or not? We can close for now and if we get feedback that it's needed can always add it later