Forum Discussion
Incident notifications on Teams
Microsoft
My apologies, I should have worded it better. First of all, there is no easy way of setting this up, unless you go and fiddle with playbooks. Most SIEMs (if not all) come with option to send email notifications per incidents. This is usually available through when you are setting up a new alert (analytics in this case). This is a useful feature in my opinion as not all businesses operate on a 24/7 SOC environment, meaning they might not have SOC analysts with Sentinel open all the time.
I have implemented the teams notification which can be seen below. Now this is useful but what would have been better if we could have had more details in here (maybe its possible to do with different playbooks) but what I would like is to see entities here as well:
the incidents page show the user, IP and so on. Would have been useful to see this information here.
As I said, this is probably doable but I think having a feature by default to include all this rather than having to use playbooks is a better idea. Playbooks are still useful for many other things and I am grateful to the community for sharing many great playbooks. But I just wish the notification feature didn't rely on playbooks.
- CliveWatsonThanks for the extra details. I know a simple method is being looked into (not confirmed). In the the meantime, playbooks allows for simple to complex emails or Teams messages to be created, please take a look at examples like this one: https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Send-email-with-formatted-incident-report
