Forum Discussion
create incident in sentinel using logic apps after running query in azure data explorer
create incident in sentinel using logic apps after running query in azure data explorer
3 Replies
- Laurie_RhodesBrass Contributor
There are issues with this approach. A big part of Sentinel is its automated Entity relationship mapping and for this to work properly Incidents need to be created from alerts or Analytic Rules acting on data in Sentinel itself. The way to resolve this is to not create an Incident directly from data in ADX but send the data from ADX to Sentinel and let Sentinel’s Analytic Rules create the Incident normally.
To get data from ADX into Sentinel it's easier to use a continuously running Function App to run KQL queries over ADX and then submit the retrieved data to Sentinel using a designated Data Collection Rule.
Doing it this way will preserve your entity relationships when Incidents are created in Sentinel. - ITProfessorBrass Contributor
Anything specific you are trying to get from adx?
- Clive_WatsonBronze Contributor
ADX doesn't have a trigger like you have for Sentinel. So you probably need to run your logic app on a schedule (every 5, 10, 15mins etc...) and have it run the code and then use the HTTP control to talk to the Incident API Incidents - Create Or Update - REST API (Azure Sentinel) | Microsoft Learn