Add advanced conditions to Microsoft Sentinel automation rules

This article explains how to add advanced "Or" conditions to automation rules in Microsoft Sentinel, for more effective triage of incidents.

Add "Or" conditions in the form of condition groups in the Conditions section of your automation rule.

Condition groups can contain two levels of conditions:

• Simple conditions: At least two conditions, each separated by an OR operator:

  • A OR B
  • A OR B OR C (Example 1B: Add more OR conditions)
  • and so on.

• Compound conditions: More than two conditions, with at least two conditions on at least one side of an OR operator:

  • (A and B) OR C
  • (A and B) OR (C and D)
  • (A and B) OR (C and D and E)
  • (A and B) OR (C and D) OR (E and F)
  • and so on.

Using condition groups with OR logic affords you great power and flexibility in determining when rules will run. It can also greatly increase your efficiency by letting you combine many old automation rules into one new rule.

Add a condition group

Since condition groups offer a lot more power and flexibility in creating automation rules, the best way to explain how to add condition groups to automation rules is by presenting some examples.

Let's create a rule that will change the severity of an incoming incident from whatever it is to High, assuming it meets the conditions we'll set.

1. Go to the Azure portal, select the Configuration > Automation page.

2. From the Automation page, select Create > Automation rule from the button bar at the top.

   See the general instructions for creating an automation rule for details.

3. Name the rule Triage: Change Severity to High.

4. Select the trigger When incident is created.

5. Under Conditions, if you see the Incident provider and Analytics rule name conditions, leave them as they are. We'll add more conditions later in this process.

6. Under Actions, select Change severity from the drop-down list.

7. Select High from the drop-down list that appears below Change severity.

Example 1: simple conditions

In this first example, we'll create a simple condition group: If either condition A or condition B is true, the rule will run and the incident's severity will be set to High.

1. Select the + Add expander and choose Condition group (Or) from the drop-down list.

   

2. See that two sets of condition fields are displayed, separated by an OR operator. The two sets of condition fields are conditions A and B, representing the two sides of a simple OR condition group: If A or B is true, the rule will run.
   (Don't be confused by all the different Add links-each one is explained in the following steps.)

   

3. Decide what these conditions will be. That is, what two different conditions will cause the incident severity to be changed to High? We suggest the following:

   • If the incident's associated MITRE ATT&CK Tactics include any of the four we've selected from the drop-down (see the image below), the severity should be raised to High.

   • If the incident contains a Host name entity named "SUPER_SECURE_STATION", the severity should be raised to High.

   

   As long as at least ONE of these conditions is true, the actions we define in the rule will run, changing the severity of the incident to High.

Example 1A: Add an OR value within a single condition

Let's say we have not one, but two super-sensitive workstations whose incidents we want to make high-severity. To add another value to an entity-property condition, select the dice icon to the right of the current condition value, and then enter an additional value below it.

Example 1B: Add more OR conditions

Let's say we want to have this rule run if one of THREE (or more) conditions is true. If A or B or C is true, the rule will run.

1. Remember all those Add links? To add another OR condition, select the + Add connected by a line to the OR operator.

   

2. Now, select the field, operator, and value for the new condition by choosing a property from the drop-down list, selecting a comparison operator, and entering the target value.

   

Example 2: Add compound conditions

In this example, we add multiple conditions to each side of an OR condition group, creating compound logic. The goal is for the rule to run if A and B are true, OR if C and D are true.

1. To add a condition to one side of an OR condition group, select the + Add link immediately below the existing condition, on the same side of the OR operator (in the same blue-shaded area) to which you want to add the new condition.

   

   You'll see a new row added under the existing condition (in the same blue-shaded area), linked to it by an AND operator.

   

2. Fill in the parameters and values for the new condition row by selecting a property, operator, and value from the drop-down lists, using the same method you used for the earlier conditions in this condition group.

   

3. On either side of the OR condition group, select the + Add link below an existing condition to add a new row, and then enter the new condition's parameters and values.

   

That's it! You can use what you've learned here to add more conditions and condition groups, using different combinations of AND and OR operators, to create powerful, flexible, and efficient automation rules to really help your SOC run smoothly and lower your response and resolution times.

Related content

• Create and use Microsoft Sentinel automation rules to manage response
• Automate incident handling in Microsoft Sentinel with automation rules
• Automate threat response with playbooks in Microsoft Sentinel.
• Tutorial: Use playbooks to automate threat responses in Microsoft Sentinel.