Forum Discussion
Can't add playbook to incident automation of an analytics rule.
Hello, whenever I add a playbook to the incident automation of an analytics rule i get this message after saving it: The playbooks won't be added to the rule. Other actions like changing t...
I don't see where you would be able to add a playbook directly to an automation rule. In the "Automated response" tab you either add a rule to the "Alert automation" section or add an automation rule to the "Incident automation" section. I can also see where you can change the status but not assign an owner (that is only done once an Incident is created).
Can you provide some screenshots?
Can you provide some screenshots?
Sure, here is a screenshot of what I'm trying to add.
And yes, I want to add it in the incident automation section.
It's also listed on the Review and update screen
But when I save the rule, I get the message from the OP, that it's only partially saved and the automation rule is gone.
- It sounds like you would need to open a ticket with Microsoft to get this resolved. In the meantime, can you create the same rule by going through Automation?
GaryBushey I tried to add the playbook directly in the incident overview, like:
After saving, I got an actual error message:
Which is discussed here: https://techcommunity.microsoft.com/t5/azure-sentinel/azure-sentinel-automation-preview-issue-with-permission/m-p/2346059