Microsoft Sentinel Automation Rules Stop Running After One Playbook Closes Incident

Question

Hi,

I have an automation rule that includes few playbooks, my question will they all run even one of the playbook closed the incident?
If they will, how can i stop them from running ?

Thanks.

Answer 1

All of the linked Playbooks will be triggered each time a new Incident matching the rule criteria is created. Most will complete very quickly. You could manually stop a long-running logic app if needed (at the app recourse blade). You could also revise your playbooks to stop automatically under your desired conditions.