Running Playbooks on Incidents

To run a Veeam playbook on the incident, perform the steps below. For more information on playbooks supported by Veeam App for Microsoft Sentinel, see Playbook Reference.

If you use Microsoft Sentinel in the Microsoft Defender portal, do the following:

1. In the portal menu, click Investigation & response > Incidents & alerts > Incidents.
2. Click the name of the incident.
3. Click Run playbook.
4. In the Run playbook on incident window, select the playbook applicable to this incident and click Run playbook in the Action column.

If you use Microsoft Sentinel in the Microsoft Azure portal, do the following:

1. In the workspace menu, click Threat management > Incidents.
2. Select the incident.
3. Click Actions > Run playbook.
4. In the Run playbook on incident window, select the playbook applicable to this incident and click Run playbook in the Action column.

The status of the playbook session is displayed on the Runs tab. To view detailed log information, click Activity log on the incident details page.