Forum Discussion

frank_df's avatar
frank_df
Copper Contributor
Jun 29, 2022

How to create a Playbook that sends an email to a user involved in an incident?

Hello everybody,

 

I need to configure a Sentinel playbook to send emails to users when an incident is created regarding their account.

I have created a playbook that uses Identity Protection incidents creation as trigger but I'm not currently able to set the right parameter to address automatically the alert to the user the incident refers to.

I don't need to set an address statically but the playbook has to fetch the user email address from the incident automatically and use it as recipient.

Which parameter or expression should I use?

 

I hope you can kindly help me with this.

 

Best regards.

  • Prashali_Shinde's avatar
    Prashali_Shinde
    Copper Contributor
    Hey frank_df, we are also looking for similar requirement, did you able to achieve this, if you are please let us know the playbook configuration, we tried to pull AAD user id and accounts UPN suffix but its not reflecting the email address.
    • frank_df's avatar
      frank_df
      Copper Contributor

      Prashali_Shinde 

      Yes, I achieved that!
      Here is my current configuration:

      NB: I added a condition because I had to send an email or another according to the UPN suffix. You can skip straight to the last step ("send an email").

       

  • frank_df You definitely need to get both the user name and the UPN from the Incident Entities. Something like the following...

     

Resources