Forum Discussion

pho30's avatar
pho30
Copper Contributor
Jan 06, 2020

Extracting Additional Data for E-mail Alert via Playbook

I have a logic app setup to be used for email alerting with one of my scheduled queries. I am able to pull out the entity data such as Account, Host, IP, etc., but is there a way to pull out other se...
GaryBushey's avatar
GaryBushey
Bronze Contributor
Jan 07, 2020

pho30 What you see in the list of dynamic content is everything that the Azure Sentinel connector will return. If you have additional fields you would like to be available I would suggest creating a new entry in the Azure Sentinel feedback page at: https://feedback.azure.com/forums/920458-azure-sentinel

 

With that being said, you can may REST calls inside of Playbooks where you can get more information from the unsupported (so far) Azure Sentinel REST API located at https://github.com/Azure/azure-rest-api-specs/tree/master/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview

 

Wortell has created some great PowerShell commands using this API that you could use as a basis for your calls.  They are located at https://github.com/wortell/AZSentinel

 

Hope this helps

Resources