I am trying to create a workflow that is triggered by a CRITICAL InsightIDR detection. I imagine the next steps would be to send a Teams message asking if we want to disable X user in EntraID. If we reply back with an affirmative, the user in question will have all sessions revoked and account disabled.
To begin with, I already have Azure AD and Teams plugin configured. I head over to Workflow, and this is where I get confused. Any help would be appreciated.