Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Migrate Splunk SOAR Automation to Microsoft Sentinel

4 September 2026Doc update+19 / −16 lines

In brief

The article’s formatting and metadata were refreshed, including clearer list and table formatting, an expanded Microsoft Sentinel Incidents REST API link, updated GitHub playbook wording, and revised next-step text.

What Defender admins need to know

Administrators can use the clearer resource links and mapping guidance; no configuration change or migration action is indicated.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Microsoft Sentinel provides Security Orchestration, Automation, and Response (SOAR) capabilities with automation rules and playbooks. Automation rules facilitate simple incident handling and response, while playbooks run more complex sequences of actions to respond and remediate threats. This article discusses how to identify SOAR use cases, and how to migrate your Splunk SOAR automation to Microsoft Sentinel automation rules and playbooks.

For more information about the differences between automation rules and playbooks, see the following articles:

Identify SOAR use cases

Here's what you need to think about when migrating SOAR use cases from Splunk.

  • Use case quality.: Choose automation use cases based on procedures that are clearly defined, with minimal variation, and a low false-positive rate.
  • Manual intervention.: Automated responses can have wide ranging effects. High impact automations should have human input to confirm high impact actions before they're taken.
  • Binary criteria.: To increase response success, decision points within an automated workflow should be as limited as possible, with binary criteria. When there are only two variables in the automated decision making, the need for human intervention is reduced and outcome predictability is enhanced.
  • Accurate alerts or data.: Response actions are dependent on the accuracy of signals such as alerts. Alerts and enrichment sources should be reliable. Microsoft Sentinel resources such as watchlists and threat intelligence with high confidence ratings enhance reliability.
  • Analyst role.: While automation is great, reserve the most complex tasks for analysts. Provide them with the opportunity for input into workflows that require validation. In short, response automation should augment and extend analyst capabilities.

Migrate SOAR workflow

|4 |Create playbooks. |Azure Logic Apps uses several connectors to orchestrate activities across Microsoft Sentinel, Azure, third party and hybrid cloud environments. | |4 |Create workbooks. |Microsoft Sentinel executes playbooks either in isolation or as part of an ordered automation rule. You can also execute playbooks manually against alerts or incidents, according to a predefined Security Operations Center (SOC) procedure. |

Map SOAR components

Review which Microsoft Sentinel or Azure Logic Apps features map to the main Splunk SOAR components.

|---------|---------| |Playbook editor |Logic App designer | |Trigger |Trigger | |•|- Connectors
•- App
•- Automation broker |•|- Connector
•- Hybrid Runbook Worker | |Action blocks |Action | |Connectivity broker |Hybrid Runbook Worker | |Community |•|- Automation > Templates tab
•- Content hub catalog
•- GitHub | |Decision |Conditional control | |Code |Azure Function connector | |Prompt |Send approval email | |Format |Data operations | |Input playbooks |Obtain variable inputs from results of previously executed steps or explicitly declared variables | |Set parameters with Utility block API utility |Manage Incidents with the Microsoft Sentinel Incidents REST API |

Operationalize playbooks and automation rules in Microsoft Sentinel

Most of the playbooks that you use with Microsoft Sentinel are available in either the Automation > Templates tab, the Content hub catalog, or Microsoft Sentinel playbook samples on GitHub. In some cases, however, you might need to create playbooks from scratch or from existing templates.

You typically build your custom logic app using the Azure Logic App Designer feature. The logic apps code is based on Azure Resource Manager (ARM) templates, which facilitate development, deployment and portability of Azure Logic Apps across multiple environments. To convert your custom playbook into a portable ARM template, you can use the ARM template generator.

Use these resourcesthe following articles and tutorials for cases where you need to build your own playbooks either from scratch or from existing templates.templates:

Next stepsstep

In this article, you learned how to map your SOAR automation from Splunk to Microsoft Sentinel.

[!div class="nextstepaction"] Export your historical data