You have an Azure subscription that contains an Microsoft Sentinel workspace.

To create a playbook in Microsoft Sentinel, you must first create an Azure Logic App.

Playbooks in Sentinel are built on top of Logic Apps—they define automated workflows that can be triggered by alerts or incidents. Once the Logic App exists, you can connect it to Sentinel via an automation rule or directly from an analytic rule.

A (Azure Function trigger): Used for custom code execution, not for Sentinel automation.

C (Hunting query): Used for threat hunting, not automation.

D (Automation rule): Connects an alert to a playbook but can’t exist before a playbook (Logic App) is created.

✅ Answer: B. an Azure Logic App