MicrosoftFor those that are stuck with the: "ActionBranchingConditionNotSatisfied" in the switch portion. moose7up
In the first HTTP GET section the example uses types: domain, hostname, and IPv4. These need be matched in the case section. The guide does mention this, but then uses URL as the example rather than one of those 3 types. So the case is trying to match URL which isn't in any of the three you used in the HTTP GET section. If you want to get to a working example only Input URL as the the type in the HTTP GET section and then follow the rest of the guide. I had also followed the guide line by line and hit the same issue. The template posted by Jmarci666 helped me realise that was the issue.
The easier way to get this working now is to use the Playbook from Azure on GitHub: https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Get-AlienVault_OTX
It is still worth understanding how this all works so you can build your own in the future or troubleshoot it when it goes wrong 🙂
