Create basic automation rules with Simple Flows in the Microsoft Defender portal (preview)

Simple Flows is a collection of pre-built automation actions in the Microsoft Defender portal. With Simple Flows, you can build a working automation rule by choosing a trigger and adding a single, ready-made action: no playbook, no Logic App. Use Simple Flows to send email notifications, update case fields, add investigation tasks, and update alerts directly from the automation rule wizard.

This article explains how Simple Flows fits into the automation rules engine, describes the new triggers and actions, shows which actions are available for each trigger, and walks through end-to-end examples for common SOC scenarios.

What is Simple Flows?

Automation rules in the Microsoft Defender portal follow a three-part model:

Trigger > Conditions > Action

A trigger is the event that starts the rule (for example, a case is created). Conditions filter which events the rule applies to (for example, only high-severity cases). Actions are the operations the rule performs when the conditions are met.

Simple Flows extends this model with new triggers and actions that target the case experience in the Defender portal, plus an alert-update action that works with the existing Alert created trigger. Each action is a single, configurable building block. You don't need to write code, build a Logic App, or generate a playbook.

Simple Flows is built for security operations center (SOC) teams who need quick, repeatable automation. Common audiences include:

• SOC analysts who want to automate routine case and alert handling without leaving the automation rules wizard.
• Security administrators who define automation policies across the SOC.
• Security engineers who extend incident response automation as part of a larger security orchestration, automation, and response (SOAR) strategy.

For a full overview of automation rules, see Automate threat response in Microsoft Sentinel with automation rules.

Prerequisites

Before you create automation rules with Simple Flows, make sure you have:

• Access to cases in the Microsoft Defender portal. Simple Flows is available to:
  • Microsoft Defender XDR customers. See Microsoft Defender XDR prerequisites for licensing requirements.
  • Microsoft Sentinel customers with a workspace onboarded to the unified security operations platform.
• One of the following roles, or an equivalent custom role with permission to manage automation rules and cases:
  • Microsoft Sentinel Contributor (to create and edit automation rules).
  • Security Operator or Security Administrator in Microsoft Defender XDR (to manage cases and alerts).
• For the Update Alert action: your account must have permission to update alerts in the source product, and (for Microsoft Sentinel alerts) the data connectors that produce the alerts must be enabled.

For a complete description of permission requirements for automation rules, see Automate threat response in Microsoft Sentinel with automation rules.

New triggers

Simple Flows adds two new triggers to the automation rules engine. The pre-existing Alert created trigger isn't part of Simple Flows but is listed here because the new Update Alert action uses it.

Trigger behaviors to know

• Loop prevention. The engine deduplicates events so that the same rule doesn't re-fire on the same case within a single evaluation cycle. This protects you from infinite loops where an automation update re-triggers the rule that produced it.
• One fire per save. When you save several changes to a case at once (for example, change severity and owner together), the Case updated trigger fires once and evaluates all conditions against the final state, not once per field.
• Old and new values. The Case updated trigger exposes both the previous and new values of changed fields, so you can write precise conditions like "Severity changed from Medium to High."
• Rule priority. If multiple rules match the same event, they run in the priority order you configure on the Automation page.

Actions reference

Simple Flows introduces six actions across two categories: case actions (driven by Case Management) and an alert action (driven by the Alerts API). All actions execute through the Unified Actions platform, which routes each action to the correct downstream service.

Trigger and action compatibility

Not every action works with every trigger. The matrix below shows the supported combinations in this release.

End-to-end walkthroughs

The following examples show how to combine Simple Flows triggers, conditions, and actions to deliver common SOC workflows.

Example 1: Auto-triage low-fidelity alerts by classification

Automatically resolve informational alerts from a specific provider as benign positives so the queue stays focused on real threats.

1. In the Microsoft Defender portal, go to Microsoft Sentinel > Automation and select + Create > Automation rule.
2. Under Trigger, select When an alert is created.
3. Under Conditions, add:
   • Provider Equals Microsoft Defender for Endpoint
   • Severity Equals Informational
4. Under Actions, add Update Alert with:
   • Classification: Benign positive
   • Status: Resolved
5. Save the rule.

Example 2: Promote tasks when a case moves to Investigating

Add a stage-appropriate checklist the moment an analyst starts investigating.

1. From Microsoft Sentinel > Automation, create a new automation rule.
2. Under Trigger, select When a case is updated.
3. Under Conditions, add: Status Changed to Investigating.
4. Under Actions, add Add Task with the tasks you want the analyst to follow during the investigation phase.
5. Save the rule.

Related content

• Automate threat response in Microsoft Sentinel with automation rules
• Create and use Microsoft Sentinel automation rules to manage response
• Automation rules reference
• Add advanced conditions to automation rules
• Create incident tasks using automation rules