Microsoft Sentinel
Cloud and workloadsMigrate ArcSight SOAR Automation to Microsoft Sentinel
In brief
The guide updates headings and navigation anchors, refines wording and punctuation, and adds definitions for ArcSight SOAR triggers, actions, and playbooks.
What Defender admins need to know
Administrators can use the clearer structure and terminology when planning or documenting SOAR migrations. No action is required.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
title: Migrate ArcSight SOAR automationAutomation to Microsoft Sentinel
description: Learn how to identify SOAR use cases, and how to migrate your ArcSight SOAR automation to Microsoft Sentinel.
author: EdB-MSFT
ms.author: edbaynash
ms.topic: how-to
ms.date: 06/15/07/01/2026
ai-usage: ai-assisted
ms.custom: msecd-doc-authoring-10141016
#Customer intent: As a security engineer, I want to migrate my ArcSight SOAR automation to Microsoft Sentinel so that analysts can leverage advanced incident handling and response capabilities.
Microsoft Sentinel provides Security Orchestration, Automation, and Response (SOAR) capabilities with automation rules and playbooks. Automation rules automate incident handling and response, and playbooks run predetermined sequences of actions to response and remediate threats. This article discusses how to identify SOAR use cases, and how to migrate your ArcSight SOAR automation to Microsoft Sentinel.
Automation rules simplify complex workflows for your incident orchestration processes, and allow you to centrally manage your incident handling automation.
With automation rules, you can:
- Perform simple automation tasks without necessarily using playbooks. For example, you can assign, tag incidents, change status, and close incidents.
- Automate responses for multiple analytics rules at once.
- Control the order of actions that are executed.
- Run playbooks for those cases where more complex automation tasks are necessary.
Identify SOAR use cases
Here’s what you need to think about when migrating SOAR use cases from ArcSight.ArcSight:
- Use case quality
.: Choose good use cases for automation. Use cases should be based on procedures that are clearly defined, with minimalvariation,variation and a low false-positive rate. Automation should work with efficient use cases. - Manual intervention
.: Automated response can have wide ranging effects and high impact automations should have human input to confirm high impact actions before they’re taken. - Binary criteria
.: To increase response success, decision points within an automated workflow should be as limited as possible, with binary criteria. Binary criteria reduces the need for humanintervention,intervention and enhances outcome predictability. - Accurate alerts or data
.: Response actions are dependent on the accuracy of signals such as alerts. Alerts and enrichment sources should be reliable. Microsoft Sentinel resources such as watchlists and reliable threat intelligence can enhance reliability. - Analyst role
.: While automation where possible is great, reserve more complex tasks foranalysts,analysts and provide them with the opportunity for input into workflows that require validation. In short, response automation should augment and extend analyst capabilities.
Migrate SOAR workflowworkflows to Microsoft Sentinel playbooks
The following mapping shows how key SOAR concepts in ArcSight translate to Microsoft Sentinel components, and provides general guidelines for how to migrate each step or component in the SOAR workflow.
|1 |Ingest events into Enterprise Security Manager (ESM) and trigger correlation events. |Ingest events into the Log Analytics workspace. |
|2 |Automatically filter alerts for case creation. |Use analytics rules to trigger alerts. Enrich alerts using the custom details feature to create dynamic incident names. |
|3 |Classify cases. |Use automation rules. With automation rules, Microsoft Sentinel treats incidents according to the analytics rule that triggered the incident, and the incident properties that match defined criteria. |
|4 |Consolidate cases. |You can consolidate several alerts to a single incident according to properties such as matching entities, alert details, or creation timeframe,timeframe by using the alert grouping feature. |
|5 |Dispatch cases. |Assign incidents to specific analysts using automated incident assignment with Shifts for Teams between Microsoft Teams, Azure Logic Apps, and Microsoft Sentinel automation rules. |
Map ArcSight SOAR components to Microsoft Sentinel capabilities
Review which Microsoft Sentinel or Azure Logic Apps features map to the main ArcSight SOAR components. In ArcSight, a trigger initiates a workflow based on an event or condition, an action performs a specific task in response, and playbooks define the orchestrated sequence of actions. The following table maps these components to their Microsoft Sentinel equivalents.
| ArcSight | Microsoft Sentinel/Azure Logic Apps |
|---|---|
| You typically build your custom logic app using the Azure Logic App Designer feature. The logic apps code is based on Azure Resource Manager (ARM) templates, which facilitate development, deployment and portability of Azure Logic Apps across multiple environments. To convert your custom playbook into a portable ARM template, you can use the ARM template generator. |
Use the following Microsoft Sentinel automation and playbook resources for cases where you need to build your own playbooks either from scratch or from existing templates.
- Automate incident handling in Microsoft Sentinel
- Automate threat response with playbooks in Microsoft Sentinel
- Tutorial: Use playbooks with automation rules in Microsoft Sentinel
- How to use Microsoft Sentinel for Incident Response, Orchestration and Automation
- Adaptive Cards to enhance incident response in Microsoft Sentinel
SOAR post Post-migration best practices for SOAR in Microsoft Sentinel
Here are best practices you should take into account after your SOAR migration:
- After you migrate your playbooks, test the playbooks extensively to ensure that the migrated actions work as expected.
- Periodically review your automations to explore ways to further simplify or enhance your SOAR. Microsoft Sentinel constantly adds new connectors and actions that can help you to further simplify or increase the effectiveness of your current response implementations.
- Monitor the performance of your playbooks using the Playbooks health monitoring workbook.
- Use managed identities and service principals: Authenticate against various Azure services within your Logic Apps, store the secrets in Azure Key Vault, and obscure the output of the flow execution. We also recommend that you monitor non-interactive service principal logins in Microsoft Sentinel.
Next stepsstep
In this article, you learned how to map your SOAR automation from ArcSight to Microsoft Sentinel.
[!div class="nextstepaction"] Export your historical data
@@ -1,12 +1,12 @@ ----title: Migrate ArcSight SOAR automation to Microsoft Sentinel+title: Migrate ArcSight SOAR Automation to Microsoft Sentinel description: Learn how to identify SOAR use cases, and how to migrate your ArcSight SOAR automation to Microsoft Sentinel. author: EdB-MSFT ms.author: edbaynash ms.topic: how-to-ms.date: 06/15/2026+ms.date: 07/01/2026 ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 #Customer intent: As a security engineer, I want to migrate my ArcSight SOAR automation to Microsoft Sentinel so that analysts can leverage advanced incident handling and response capabilities.@@ -17,24 +17,27 @@ ms.custom: msecd-doc-authoring-1014 Microsoft Sentinel provides Security Orchestration, Automation, and Response (SOAR) capabilities with [automation rules](automate-incident-handling-with-automation-rules.md) and [playbooks](tutorial-respond-threats-playbook.md). Automation rules automate incident handling and response, and playbooks run predetermined sequences of actions to response and remediate threats. This article discusses how to identify SOAR use cases, and how to migrate your ArcSight SOAR automation to Microsoft Sentinel. -Automation rules simplify complex workflows for your incident orchestration processes, and allow you to centrally manage your incident handling automation. +Automation rules simplify complex workflows for your incident orchestration processes, and allow you to centrally manage your incident handling automation. -With automation rules, you can: -- Perform simple automation tasks without necessarily using playbooks. For example, you can assign, tag incidents, change status, and close incidents. -- Automate responses for multiple analytics rules at once. -- Control the order of actions that are executed. -- Run playbooks for those cases where more complex automation tasks are necessary. +With automation rules, you can:++- Perform simple automation tasks without necessarily using playbooks. For example, you can assign, tag incidents, change status, and close incidents.+- Automate responses for multiple analytics rules at once.+- Control the order of actions that are executed.+- Run playbooks for those cases where more complex automation tasks are necessary. ## Identify SOAR use cases -Here’s what you need to think about when migrating SOAR use cases from ArcSight.-- **Use case quality**. Choose good use cases for automation. Use cases should be based on procedures that are clearly defined, with minimal variation, and a low false-positive rate. Automation should work with efficient use cases.-- **Manual intervention**. Automated response can have wide ranging effects and high impact automations should have human input to confirm high impact actions before they’re taken.-- **Binary criteria**. To increase response success, decision points within an automated workflow should be as limited as possible, with binary criteria. Binary criteria reduces the need for human intervention, and enhances outcome predictability.-- **Accurate alerts or data**. Response actions are dependent on the accuracy of signals such as alerts. Alerts and enrichment sources should be reliable. Microsoft Sentinel resources such as watchlists and reliable threat intelligence can enhance reliability.-- **Analyst role**. While automation where possible is great, reserve more complex tasks for analysts, and provide them with the opportunity for input into workflows that require validation. In short, response automation should augment and extend analyst capabilities. +Here’s what you need to think about when migrating SOAR use cases from ArcSight:++- **Use case quality**: Choose good use cases for automation. Use cases should be based on procedures that are clearly defined, with minimal variation and a low false-positive rate. Automation should work with efficient use cases.+- **Manual intervention**: Automated response can have wide ranging effects and high impact automations should have human input to confirm high impact actions before they’re taken.+- **Binary criteria**: To increase response success, decision points within an automated workflow should be as limited as possible, with binary criteria. Binary criteria reduces the need for human intervention and enhances outcome predictability.+- **Accurate alerts or data**: Response actions are dependent on the accuracy of signals such as alerts. Alerts and enrichment sources should be reliable. Microsoft Sentinel resources such as watchlists and reliable threat intelligence can enhance reliability.+- **Analyst role**: While automation where possible is great, reserve more complex tasks for analysts and provide them with the opportunity for input into workflows that require validation. In short, response automation should augment and extend analyst capabilities. -## Migrate SOAR workflow+<a name="migrate-soar-workflow"></a>+## Migrate SOAR workflows to Microsoft Sentinel playbooks The following mapping shows how key SOAR concepts in ArcSight translate to Microsoft Sentinel components, and provides general guidelines for how to migrate each step or component in the SOAR workflow. @@ -45,12 +48,13 @@ The following mapping shows how key SOAR concepts in ArcSight translate to Micro |1 |Ingest events into Enterprise Security Manager (ESM) and trigger correlation events. |Ingest events into the Log Analytics workspace. | |2 |Automatically filter alerts for case creation. |Use [analytics rules](detect-threats-built-in.md) to trigger alerts. Enrich alerts using the [custom details feature](surface-custom-details-in-alerts.md) to create dynamic incident names. | |3 |Classify cases. |Use [automation rules](automate-incident-handling-with-automation-rules.md). With automation rules, Microsoft Sentinel treats incidents according to the analytics rule that triggered the incident, and the incident properties that match defined criteria. |-|4 |Consolidate cases. |You can consolidate several alerts to a single incident according to properties such as matching entities, alert details, or creation timeframe, using the alert grouping feature. |+|4 |Consolidate cases. |You can consolidate several alerts to a single incident according to properties such as matching entities, alert details, or creation timeframe by using the alert grouping feature. | |5 |Dispatch cases. |Assign incidents to specific analysts using [automated incident assignment with Shifts for Teams](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/automate-incident-assignment-with-shifts-for-teams/ba-p/2297549) between Microsoft Teams, Azure Logic Apps, and Microsoft Sentinel automation rules. | -## Map SOAR components +<a name="map-soar-components"></a>+## Map ArcSight SOAR components to Microsoft Sentinel capabilities -Review which Microsoft Sentinel or Azure Logic Apps features map to the main ArcSight SOAR components.+Review which Microsoft Sentinel or Azure Logic Apps features map to the main ArcSight SOAR components. In ArcSight, a *trigger* initiates a workflow based on an event or condition, an *action* performs a specific task in response, and *playbooks* define the orchestrated sequence of actions. The following table maps these components to their Microsoft Sentinel equivalents. |ArcSight |Microsoft Sentinel/Azure Logic Apps | |---------|---------|@@ -68,24 +72,24 @@ Most of the playbooks that you use with Microsoft Sentinel are available in eith You typically build your custom logic app using the Azure Logic App Designer feature. The logic apps code is based on [Azure Resource Manager (ARM) templates](/azure/azure-resource-manager/templates/overview), which facilitate development, deployment and portability of Azure Logic Apps across multiple environments. To convert your custom playbook into a portable ARM template, you can use the [ARM template generator](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/export-microsoft-sentinel-playbooks-or-azure-logic-apps-with/ba-p/3275898). Use the following Microsoft Sentinel automation and playbook resources for cases where you need to build your own playbooks either from scratch or from existing templates.+ - [Automate incident handling in Microsoft Sentinel](automate-incident-handling-with-automation-rules.md) - [Automate threat response with playbooks in Microsoft Sentinel](automate-responses-with-playbooks.md) - [Tutorial: Use playbooks with automation rules in Microsoft Sentinel](tutorial-respond-threats-playbook.md) - [How to use Microsoft Sentinel for Incident Response, Orchestration and Automation](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/how-to-use-azure-sentinel-for-incident-response-orchestration/ba-p/2242397) - [Adaptive Cards to enhance incident response in Microsoft Sentinel](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/using-microsoft-teams-adaptive-cards-to-enhance-incident/ba-p/3330941) -## SOAR post migration best practices+<a name="soar-post-migration-best-practices"></a>+## Post-migration best practices for SOAR in Microsoft Sentinel Here are best practices you should take into account after your SOAR migration: - After you migrate your playbooks, test the playbooks extensively to ensure that the migrated actions work as expected. - Periodically review your automations to explore ways to further simplify or enhance your SOAR. Microsoft Sentinel constantly adds new connectors and actions that can help you to further simplify or increase the effectiveness of your current response implementations. - Monitor the performance of your playbooks using the [Playbooks health monitoring workbook](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-monitoring-your-logic-apps-playbooks-in-azure/ba-p/1873211).-- Use managed identities and service principals: Authenticate against various Azure services within your Logic Apps, store the secrets in Azure Key Vault, and obscure the output of the flow execution. We also recommend that you [monitor the activities of these service principals](https://techcommunity.microsoft.com/t5/azure-sentinel/non-interactive-logins-minimizing-the-blind-spot/ba-p/2287932).--## Next steps+- Use managed identities and service principals: Authenticate against various Azure services within your Logic Apps, store the secrets in Azure Key Vault, and obscure the output of the flow execution. We also recommend that you [monitor non-interactive service principal logins in Microsoft Sentinel](https://techcommunity.microsoft.com/t5/azure-sentinel/non-interactive-logins-minimizing-the-blind-spot/ba-p/2287932). -In this article, you learned how to map your SOAR automation from ArcSight to Microsoft Sentinel. +## Next step > [!div class="nextstepaction"] > [Export your historical data](migration-arcsight-historical-data.md)