Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Respond to Threat Actors During Investigations and Threat Hunts in Microsoft Sentinel

4 September 2026Doc update+18 / −20 lines

In brief

The article now uses clearer entity-reference link labels, updates wording for launching playbooks from incident views, refreshes metadata, and reorganizes related links.

What Defender admins need to know

Administrators get clearer navigation and instructions when running playbooks during incident investigations or threat hunts. No action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

This article shows you how to take response actions against threat actors on the spot, during the course of an incident investigation or threat hunt, without pivoting or context switching out of the investigation or hunt. You accomplish this using playbooks based on the new entity trigger.

The entity trigger currently supports the following entity types:

When you're investigating an incident, and you determine that a given entity - a user account, a host, an IP address, a file, and so on - represents a threat, you can take immediate remediation actions on that threat by running a playbook on-demand. You can do likewise if you encounter suspicious entities while proactively hunting for threats outside the context of incidents.

  1. Select the entity in whichever context you encounter it, and choose the appropriate means to run a playbook, as follows:

    • In the Entities widget on an incident's Overview tab in the new incident details page (now in Preview), or in its Entities tab, choose an entity from the list, select the three dots next to the entity, and select Run playbook (Preview) from the pop-up menu.

      :::image type="content" source="media/respond-threats-during-investigation/incident-details-overview.png" alt-text="Screenshot of incident details page.":::

      :::image type="content" source="media/respond-threats-during-investigation/entities-tab.png" alt-text="Screenshot of entities tab on incident details page.":::

    • In thean incident's Entities tab of an incident,tab, choose the entity from the list and select the Run playbook (Preview) link at the end of its line in the list.

      :::image type="content" source="media/respond-threats-during-investigation/incident-details-page.png" alt-text="Screenshot of selecting entity from incident details page to run a playbook on it.":::

      :::image type="content" source="media/respond-threats-during-investigation/entity-page.png" alt-text="Screenshot of the selected entity page to run a playbook on an entity.":::

  2. EachSelecting Run playbook (Preview) from any of these actionsthe views described in step 1 opens the Run playbook on <entity type> panel.

    :::image type="content" source="media/respond-threats-during-investigation/run-playbook-on-entity.png" alt-text="Screenshot of Run playbook on entity panel.":::

  3. You can audit the activity of your entity-trigger playbooks in the Runs tab. You'll see a list of all the times any playbook has been run on the entity you selected. It might take a few seconds for any just-completed run to appear in this list. Selecting a specific run will open the full run log in Azure Logic Apps.

Next stepsRelated content

In this article, you learned how to run playbooks manually to remediate threats from entities while in the middle of investigating an incident or hunting for threats.