Forum Discussion
Extract Email Address from Incident Entity
I'm trying to put together a logic app that will reset a users password and also send them as email notifying them why their password was reset. The logic app triggers off a sentinel incident.
The users email address I need to send to is from the Entities properties of the Sentinel incident. How can I extract the users email address? Its in the "MailAddress" property of each Entity. I believe Im going to have to parse it out of the JSON result but need some guidance if that is the case. Appreciate any help.
4 Replies
Would it be possible to go into a bit more detail about how to set that up using a logic app? Sorry a little green here with logic apps and I'm a bit stumped on how to a foreach loop on relatedEntities. Much appreciated.
Thanks Gary, so I have done that and see pic for the result, I'm trying to figure out how I can extract the MailAddress property for the user, its under Properties --> Additional Data, see pic
I used this for the sample payload to extract the schema, I can then see the mailaddress to select it but when I run, the json validation always fails
Since the information being returned is part of a JSON array, you would need to perform a loop to get all the entries in it. Kind of surprised that Logic App didn't automatically do this for you when using that field. You would need to do a loop on "relatedEntities" and then you can send the Email(s)
The easiest way is to create a playbook that just has the Sentinel Entity trigger and kick that off from an incident that is the same type as the one you want. Then you can see all the data that the trigger contains. This will tell you if you need to either make another query or perhaps use the Sentinel Connector to get more entities, like Accounts
