Forum Discussion
Close incident MCAS Playbook
RobYoung A couple of things
1) This playbook uses the "When a response to an Azure Sentinel alert is triggered" so it would never trigger when you close an Incident (there actually is no trigger for that yet(
2) Not sure how this would work since, if I am reading the workflow correctly, it is triggered when an alert is generated, it closes the incident and for all the alerts from the incident in the incident, it calls the MCAS URL to close the alert. So basically, when the alert is created in Azure Sentinel it will immediately close the incident and all all alerts in MCAS immediately. This does not sound like what you want to do.
You can use this as the basis of your playbook, but rather than using the Azure Sentinel trigger you would need to use a timer job to check for closed incidents that were created by the MCAS alert and then continue to run the workflow if you find any.
RobYoung A couple of things
1) This playbook uses the "When a response to an Azure Sentinel alert is triggered" so it would never trigger when you close an Incident (there actually is no trigger for that yet(
2) Not sure how this would work since, if I am reading the workflow correctly, it is triggered when an alert is generated, it closes the incident and for all the alerts from the incident in the incident, it calls the MCAS URL to close the alert. So basically, when the alert is created in Azure Sentinel it will immediately close the incident and all all alerts in MCAS immediately. This does not sound like what you want to do.
You can use this as the basis of your playbook, but rather than using the Azure Sentinel trigger you would need to use a timer job to check for closed incidents that were created by the MCAS alert and then continue to run the workflow if you find any.
Maybe I will try and craft something that will batch it a couple times a day and that way, I can at least close it with the same classification that I used to close it in Sentinel.
Thanks for the tips and input
