Forum Discussion
Azure Sentinel Logic App Get Incidents is failing with BadGateway
Here is how we have the Alert - Get incidents configured. Here is the output we are getting. "error": { "code": 500, "source": "logic-apis-eastus2.azure-apim.net", "clientReques...
Unfortunately, it is not documented on the github that in order to deploy the playbook ARM templates, one of the steps is you MUST give the service principal you're using for the initial "when an event happens" sentinel trigger the necessary reader permissions (at minimum) to the log analytics workspace serving your sentinel deployment. Seems obvious, sure, but it also seems obvious that it should be documented in the step by step install instructions in the readme....
