Forum Discussion
Alert - Get incident
Hey, I am trying to implement a Logic App with Alert - Get incident with an Azure Sentinel alert trigger and i get the following error when running: {
"error": {
"code": 400,
"so...
Actually i need to retrieve sentinel incidents using logic app can anyone share a way to do it ?
akefallonitis I just wrote a blog post on doing that. Make sure to read Part 1 and 2 as I changed some of the ways I did the logic app in Part 2. Part 3 gives you a workbook to start from that uses the data.
Hi Gary very nice!
Just one question what permissions the app needs to have to access and write the incidents ?
akefallonitis that was mentioned in the blog post:
One additional step you will need to take is to give this App the Azure Sentinel Reader rights at the some level. You can use either the Subscription, Resource Group, or Log Analytics workspace level and I would recommend the Log Analytics workspace level just for added security.
