Connect Microsoft Sentinel incidents to security, IT and supplier work. Service Automation Suite adds context, connects the agreed service task and makes confirmed resolution traceable. The security team retains control of assessment and security actions.
The work between your applications
From Sentinel incident to accountable follow-up.
Connect Microsoft Sentinel incidents to security, IT and supplier work. Service Automation Suite adds context, connects the agreed service task and makes confirmed resolution traceable. The security team retains control of assessment and security actions.
A change, request or alert
Service Automation Suite
Data, people, assets and relationships on one foundation.
Compare
What exists? What should exist?
Determine what is needed
Matrix · policy · legal requirements
Coordinate the next steps
Checks · tasks · approvals · actions
Execution ↔ feedback
Your people and tools
Microsoft SentinelMicrosoft Defender
For example. Also with other teams, suppliers and applications.
Verify. Inform. Report.
What is complete? Who needs to act? Which exception needs attention?
Start with one integration, register or check. Build on the same data and rules.
Combine into one controlled process
Data → rules → execution
Combine
Alert + device + service rules
Determine & check
Add context, determine priority and route
Execute & report back
Create or update ticket · Involve the right team · Track resolution
Check sources and rules, test changes and track the outcome. Manual tasks get an owner and confirmation.
Build visually. Manage easily.
Reuse building blocks, adapt your process and test the change. Manage it yourself, together with us or let Scope4mation take care of it.
Scenarios in practice
What would you like to do with Microsoft Sentinel?
Choose a use case and explore the related workflow steps.
Who follows up the incident outside the security portal?
An incident may require work from endpoint management or a supplier. Share only necessary context and keep the source incident, service task and confirmation connected.
Service Automation Suite · Central coordination
Match, compare and follow up
Combine the data with your policy, risk assessments and checks. Request information or a decision where needed, track actions and record the outcome.
Use the correct Sentinel workspace, available fields and suitable read permissions. Distinguish retrieval failures from an empty selection.
Connect the existing investigation
Relate the incident ID and available device reference to the correct service task. Repeated signals should not repeatedly create new work.
Confirm execution
Have the authorised team review the action and result. Writing back to Sentinel or starting a playbook requires a separately approved configuration.
Connect work across your applications
What would you like to connect Microsoft Sentinel with?
Choose the role in your workflow. Explore applications from the scenarios and further directions to discuss together. We define the data, actions and available interface for each combination.
Why connect Microsoft Sentinel with Service Automation Suite and Scope4mation?
Get more from Microsoft Sentinel and the applications you already use. Our Dutch technology and process expertise connect the whole chain. Stay in control of your data, configuration and how you build further.
Service Automation Suite + Scope4mation
Process & control
One process, your own applications
Use the data you already maintain. Service Automation Suite connects requests, decisions and execution across HR, IT, facilities and suppliers. Reduce retyping and chasing separate tasks.
Who has what — and why?
Compare what someone has with what your rules require and permit. Connect discrepancies to review, action and verification of the outcome.
Share data with a purpose
Which data goes where, for what purpose and who may access it? Incorporate your classification and security requirements into the configuration of each data flow.
Autonomy & choice
Your process shapes the chain
Combine the applications that fit your organisation. Connect data and workflow steps across suppliers, so one application does not dictate your entire way of working.
Developed and supported from the Netherlands
Service Automation Suite is our own technology. At Scope4mation, you work with the people who develop the platform and help configure workflows. Discuss your needs and next steps directly with us.
Keep your options for tomorrow
Keep configuration and process knowledge transferable. When things change, we assess what can be reused, what needs adapting and how to hand over data and operations.
Build & operate together
A toolbox to keep building
Connect your applications using visual building blocks. Start with one use case and reuse connections, data and actions for the next. Build yourself, learn together and expand deliberately.
Process expertise and technical delivery
We help work through the whole process: from the current and desired state to configuration, exceptions and handover. Combining your practical knowledge with our integration and process experience.
Operate it your way
Self-Managed, Co-Hosted or Managed: operate it yourself, together, or entrust the agreed operations to us. Clarify services, maintenance, costs and expansion upfront.
Under the hood
This integration, step by step.
How we configure this example
Who follows up the incident outside the security portal?
Connect and retrieve
Use the correct Sentinel workspace, available fields and suitable read permissions. Distinguish retrieval failures from an empty selection.
Find the correct record
Relate the incident ID and available device reference to the correct service task. Repeated signals should not repeatedly create new work.
Execute the agreed action
Have the authorised team review the action and result. Writing back to Sentinel or starting a playbook requires a separately approved configuration.
Verify the outcome
Record verified outcomes and exceptions. Leave changes to permissions, source status or assessment with the authorised owner.
In this integration
Identification
Stable source reference and the agreed work or device reference
Data
Only agreed available fields, including provenance and observation time
Feedback
Reviewed outcome and traceable follow-up; write-back only if separately agreed
Start with one use case. Connect customer, employee and asset data, for example, and agree which source is authoritative. Reuse those relationships, a matrix where needed and configured actions in the next workflow. Agree who maintains the data and rules. Expand without repeatedly connecting and maintaining the same information.
Supplier finished. Is the internal work complete?
A supplier closes its ticket while internal verification or user confirmation is still missing.
Combine
Relate both tickets and the affected service. Use external completion to trigger a check, not automatically close the internal ticket.
The outcome determines what follows
Confirmed: complete internally. Rejected: return the reason and request correction. No response: assign follow-up to the agreed group.
The benefit
Fewer prematurely closed tickets and clear ownership of the next action.
A replacement laptop without losing context.
An employee receives a replacement device. The old asset, new record and open service or security tickets must remain connected.
Combine
Use the central relationship between owner and device identifiers. Combine handover, technical inventory and return with existing tickets.
The outcome determines what follows
Receipt confirmed: update ownership and relationships. Old device missing or uncertain match: start a targeted review instead of overwriting historical records.
The benefit
Current records and a traceable handover even when a management tool uses different names.
Refreshing a report does not guarantee reliable data.
A source request can succeed while data is missing, differently coded or not yet fully retrieved.
Combine
Combine pagination and output mapping with agreed data checks. Use shared relationship tables to connect sources.
The outcome determines what follows
Checks passed: prepare the dataset. Deviation: request review and expose freshness. Temporary API failures follow a bounded recovery path.
The benefit
A clearer distinction between a technically successful import and information fit for decision-making.
Your process needs more than a standard action?
Configure the missing API request, input and output in API Composer. Use its response in the next step and combine it with data tables, forms and automations. Extend the same product and reuse the configured building blocks.
Use Service Automation Suite to update a ticket in TOPdesk, for example, with fields available through its API, such as category, priority, status and support group. For another application, configure its request and field mapping. The outcome determines the next action: confirm, add information or request review, not merely check whether the request arrived.
Need to publish data or let others submit it? Endpoint Composer exposes a configured Service Automation Suite data object with selected methods and security profiles. Other building blocks handle subsequent processing.
Pull up a chair. Or join us online.
Over coffee, tea or online: tell us what you are working on.
We can help with the integrations, automation and coordination your process needs, even if your application is not listed yet.
Microsoft Defender
