How to create a playbook in Azure Sentinel that detects, alerts, and removes email forwarding rule(s) from Office 365?

Muhammad Waqar 1 Reputation point
2020-09-28T17:21:08.89+00:00

Hi All,
I would like to know how to create an Azure Sentinel playbook that does the following:

  1. Detects email forwarding rule(s) in Office 365
  2. If there are any, delete the forwarding rule(s)
  3. sends an alert email to the admin(s) regarding the forwarding rule(s)

Regards,
Muhammad

Azure Logic Apps
Azure Logic Apps
An Azure service that automates the access and use of data across clouds without writing code.
2,856 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
986 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. ChaitanyaNaykodi-MSFT 23,031 Reputation points Microsoft Employee
    2020-10-01T23:57:20.887+00:00

    Hello @Muhammad Waqar , I am sorry for the delay in my response. For detecting a forwarding rule in Sentinel you can use the fusion technology to detect suspicious inbox forwarding rule or you can use query office 365 logs something familiar as shown here. Regarding deleting forwarding rules, I could not find anything specific in Sentinel/ Logic App and I am not sure if it is possible using Office 365 Management API but you can definitely explore it and use Logic Apps custom connector integrate if needed. This new upcoming feature of Office 365 ATP might also interest you. Regarding sending alerts to the Admin, you can generate a playbook to send alerts or use the Office 365 connector for logic app. Please let me know if there are any additional concerns.

    0 comments