Auto-block brute-force IPs from Azure Sentinel alerts
Build a workflow that receives Azure Sentinel alerts through an event subscription/webhook. Inspect the alert type; if it indicates a brute-force attack, extract the source IP and create/update an Azure Network Security Group deny rule to block it. Skip allowlisted/internal IPs, deduplicate repeat blocks, and confirm rule creation. Retry Azure API failures and log every block. Output the blocked IP and rule reference.
What this prompt builds
Catch brute-force alerts from Sentinel and block the source IP with an Azure network security rule automatically.
The problem
Brute-force attacks generate Sentinel alerts faster than analysts can respond, and every minute an attacking IP stays reachable raises the odds of a successful login. Manual NSG edits are slow and error-prone under pressure.
Solution and impact
This workflow receives Sentinel alerts via webhook and, for brute-force detections, adds an NSG rule blocking the source IP. Attacking IPs are contained automatically within seconds of detection.