@@ -4,23 +4,25 @@ description: Generate playbooks through natural language conversations directly ms.author: monaberdugo author: mberdugo ms.topic: how-to-ms.date: 06/12/2026+ms.date: 08/07/2026 ms.service: microsoft-sentinel appliesto:     - Microsoft Sentinel in the Microsoft Defender portal ms.collection: usx-security ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1015 #Customer intent: As a security analyst, I want to generate playbooks using AI so that I can quickly create automation workflows without extensive coding knowledge.  ---  # Generate playbooks using AI in Microsoft Sentinel -The SOAR playbook generator creates python based automation workflows coauthored through a conversational experience with Cline, an AI coding agent. You describe automation logic in natural language, and the system generates validated, code-based playbooks with complete documentation and visual flow diagrams. This experience is powered by an embedded VS Code environment within the Defender portal, so you can author and refine playbooks without leaving the portal. Generated playbooks use alert data as input and dynamically generate the required API calls, as long as you configure the integration for the target provider.+The SOAR playbook generator creates python based automation workflows coauthored through a conversational experience with Cline, an AI coding agent. You describe automation logic in natural language, and the system generates validated, code-based playbooks with complete documentation and visual flow diagrams. The playbook generation experience is powered by an embedded VS Code environment within the Defender portal, so you can author and refine playbooks without leaving the portal. Generated playbooks use alert data as input and dynamically generate the required API calls, as long as you configure the integration for the target provider.  This article describes how to generate playbooks by using AI, configure required integrations, and deploy your automation workflows. +The AI-powered playbook generator is available to Microsoft Sentinel customers in the Microsoft Defender portal. It doesn't require a separate Microsoft Security Copilot license or Security Compute Units.+ Playbook generation provides the following capabilities:  - **Co-author with AI**: Build playbooks through natural language conversations with Cline, an AI coding agent hosted in a VS Code environment embedded in the Defender portal.@@ -39,19 +41,14 @@ You also must meet the following requirements:  ### Environment requirements -- **Security Copilot**: Your tenant must be [Security Copilot enabled with Security Compute Units (SCUs) available](/copilot/security/get-started-security-copilot#option-1-recommended-provision-capacity-through-security-copilot). You aren't billed for SCUs, but their availability is a technical requirement.--- **Microsoft Sentinel workspace**: Your tenant must have a Microsoft Sentinel workspace onboarded to Microsoft Defender. To create a new workspace, see [Create a workspace](/copilot/security/manage-workspaces#create-a-workspace).--- **Recommended Data sharing preferences**: In Security Copilot, enable the first slider, *Allow Microsoft to capture data from Security Copilot to validate product performance using human review*, in Customer Data Sharing preferences. For more information, see [Privacy and data security in Microsoft Security Copilot](/security-copilot/privacy-data-security).+- **Microsoft Sentinel workspace**: You must have a Microsoft Sentinel workspace onboarded to the Microsoft Defender portal.  ### Required roles and permissions   You need the following permissions in [Microsoft Defender unified role-based access control (RBAC)](/defender-xdr/custom-permissions-details):  -- **To use the playbook generator**:-  - Authorization and settings: **Detection tuning (manage)**-  - Security operations: **Security Copilot (read)**+- **To generate and deploy playbooks**:+  - Automation: **Automation Playbooks (Read and Write)**   - **To author automation rules**:   - **Microsoft Sentinel Contributor** role on the relevant Workspaces or Resource Groups containing them in Defender.@@ -59,39 +56,6 @@ You need the following permissions in [Microsoft Defender unified role-based acc > [!NOTE] > Permissions might take up to two hours to take effect after assignment. -### Required: Configure a dedicated Security Copilot workspace--If you don't already have a dedicated Security Copilot workspace for AI-generated playbooks that's set in geo **US** or **Europe**, or allowing cross-region evaluation, you need to [create a Security Copilot workspace](/copilot/security/manage-workspaces#create-a-workspace).--1. In the **Create a new workspace** dialog:--   1. Enable the following privacy flags:--      - **Allow Microsoft to capture data to validate product performance**-      - **Allow Microsoft to capture and review data to build and validate Microsoft's security AI model**--   1. Accept the Terms and Conditions.--   1. Under **Capacity**, select **Create a new capacity**.--      :::image type="content" source="./media/generate-playbook/create-new-capacity.png" alt-text="Screenshot of Create new workspace dialog with Create a new capacity link highlighted." lightbox="./media/generate-playbook/create-new-capacity.png":::--1. Configure the new capacity:--   In the **Create a Security capacity** dialog:--   1. Choose your Azure subscription, resource group, and capacity name.--   1. Set **Prompt evaluation location** to **United States** or **Europe**. If you select a different location, check the box: **If this location has too much traffic, allow Copilot to evaluate prompts anywhere in the world**.--   1. Adjust compute units and allow overage settings. The playbook generator doesn't consume Security Compute Units (SCUs), but you need to configure the capacity to meet these technical requirements for playbook generation.--   1. Select **Create**.--:::image type="content" source="./media/generate-playbook/create-capacity.png" alt-text="Screenshot of the new capacity details." lightbox="./media/generate-playbook/create-capacity.png":::--Generated playbooks automatically use the dedicated Security Copilot workspace you created.- ## Key concepts  Before you generate a playbook, understand the following concepts that the playbook generator relies on.@@ -117,7 +81,7 @@ The Enhanced Alert Trigger extends automation capabilities beyond the standard a - **Tenant-level application**: Ensure consistency across multiple workspaces - **Advanced conditions**: Define granular criteria for triggering automation -This trigger mechanism enables automatic execution of generated playbooks across your security ecosystem.+The Enhanced Alert Trigger enables automatic execution of generated playbooks across your security ecosystem.  ## Generate a new playbook @@ -213,7 +177,7 @@ Create the generated playbook in the Microsoft Defender portal by completing the     An embedded Visual Studio Code environment opens with Cline. -:::image type="content" source="./media/generate-playbook/playbook-name.png" alt-text="Screenshot of the embedded Visual Studio Code environment with the playbook generator." lightbox="./media/generate-playbook/playbook-name.png":::+    :::image type="content" source="./media/generate-playbook/playbook-name.png" alt-text="Screenshot of the embedded Visual Studio Code environment with the playbook generator." lightbox="./media/generate-playbook/playbook-name.png":::  #### Work in Plan mode @@ -230,7 +194,7 @@ When the editor opens, the playbook generator session starts in **Plan mode**. I  1. If the playbook generator requests approval to fetch documentation URLs, approve the request. This approval allows the playbook generator to access relevant API documentation to generate accurate code. -:::image type="content" source="./media/generate-playbook/approval-request.png" alt-text="Screenshot of the approval request dialog in the embedded Visual Studio Code environment." lightbox="./media/generate-playbook/approval-request.png":::+    :::image type="content" source="./media/generate-playbook/approval-request.png" alt-text="Screenshot of the approval request dialog in the embedded Visual Studio Code environment." lightbox="./media/generate-playbook/approval-request.png":::  1. The playbook generator analyzes your request and might:    - Ask clarifying questions@@ -258,26 +222,29 @@ After the playbook generator produces a plan, review and approve it before proce  1. When satisfied with the plan, follow instructions and switch to **Act mode**. -:::image type="content" source="./media/generate-playbook/act-mode.png" alt-text="Screenshot of the embedded Visual Studio Code environment in Act mode with the playbook generator." lightbox="./media/generate-playbook/act-mode.png":::+    :::image type="content" source="./media/generate-playbook/act-mode.png" alt-text="Screenshot of the embedded Visual Studio Code environment in Act mode with the playbook generator." lightbox="./media/generate-playbook/act-mode.png":::  #### Generate the playbook in Act mode -1. After you switch to Act mode, the playbook generator delivers:+1. After you switch the playbook generator session to Act mode, the playbook generator delivers:    - The complete playbook code in Python    - Code validation    - Comprehensive documentation, including a visual flow diagram and description of the playbook in natural language  1. The playbook generator asks the user for an Alert ID to run a test of the playbook. Before it executes the test, the playbook generator outlines the changes that will be applied to the environment and requests the user’s approval to proceed. -1. The tool might request approval for code generation. To enable automatic generation without approval prompts, select the **Edit** checkbox under **Auto-approve**.+1. The playbook generator might request approval for code generation. To enable automatic generation without approval prompts, select the **Edit** checkbox under **Auto-approve**. -:::image type="content" source="./media/generate-playbook/auto-approve.png" alt-text="Screenshot of the Autoapprove checkbox in the embedded Visual Studio Code environment." lightbox="./media/generate-playbook/auto-approve.png":::+    :::image type="content" source="./media/generate-playbook/auto-approve.png" alt-text="Screenshot of the Autoapprove checkbox in the embedded Visual Studio Code environment." lightbox="./media/generate-playbook/auto-approve.png":::     > [!TIP]-   > When you select **Save** in the chat, it saves the current step and confirms your approval. **It doesn't save the entire playbook**.+   > When you select **Save** in the chat, the playbook generator saves the current step and confirms your approval. **It doesn't save the entire playbook**.  #### Validate and save your playbook +> [!IMPORTANT]+> Newly created playbooks are disabled by default. After you validate and save your playbook, you must enable it before it can run.+ 1. To ensure correctness, manually review the generated code and documentation.  1. To preview the documentation in Markdown format:@@ -290,7 +257,7 @@ After the playbook generator produces a plan, review and approve it before proce  1. Close the editor when finished. -:::image type="content" source="./media/generate-playbook/preview.png" alt-text="Screenshot of the preview of an alert notification created with the playbook generator." lightbox="./media/generate-playbook/preview.png":::+    :::image type="content" source="./media/generate-playbook/preview.png" alt-text="Screenshot of the preview of an alert notification created with the playbook generator." lightbox="./media/generate-playbook/preview.png":::  ## Enable and deploy your playbook @@ -350,7 +317,8 @@ The following are examples of prompts you can use to generate playbooks for comm       data and adds the results as a comment to the related incident. - Create a playbook that blocks an AWS IAM user, assigns the alert to John, and adds a remediation comment when a high severity alert includes an IAM user entity. -## Limitations+<a name="limitations"></a>+## Limitations of AI-generated playbooks  Be aware of the following limitations when working with generated playbooks: @@ -395,4 +363,3 @@ Enhanced alert trigger rules have the following limitations: - [Create and manage Microsoft Sentinel playbooks](create-playbooks.md) - [Automate and run Microsoft Sentinel playbooks](run-playbooks.md) - [Authenticate playbooks to Microsoft Sentinel](authenticate-playbooks-to-sentinel.md)-- [Privacy and data security in Microsoft Security Copilot](/security-copilot/privacy-data-security)