I want to create one playbook for SIR (Device Theft/stolen) but I stuck somewhere

[Siva_Prasad]

The following are the activities for the playbook 
activity 1:account remediation 
Revoke MFA sessions -Azure
Password reset instruction
webex access token revocation 
Force remove zscaler

activity 2:asset/ device remediation
Disable asset -active directory
isolate asset - defender
unenroll personal device
unenroll from MFA

If anyone have any sample template of this , please do send me , TIA.

Regards,
Siva.

[Ankur Bawiskar]

@Siva_Prasad 

where are you stuck?

If my response helped please mark it correct and close the thread so that it benefits future readers.

[Siva_Prasad]

Im not getting the fields option to select in activity, if any sample playbook is there, could u please share me ?

[Ankur Bawiskar]

@Siva_Prasad 

if those activities are available as part of some plugin etc then only those will be available OOTB.

Did you check that?

If my response helped please mark it correct and close the thread so that it benefits future readers.