Forum Discussion
Playbook to have more details when alerted as email
I have a playbook designed for the Azure Sentinel Alert but when the playbook is executed the email is sent with Alert display name
How to get the Event count, User ID and Link to Azure Sentinel alert page in the body of email when the playbook is executed.
1 Reply
- Rod_Trent
Microsoft
ss1247 We're working on that and have a new SecurityIncident table in Private Preview that will solve what you're looking for. You can join the private preview program for Azure Sentinel at the following link:
In the interim, you can get this information through the API, but also it's available by digging in and doing some additional parsing in your queries. Here's an example of getting the Incident URL:
https://secureinfra.blog/2020/06/11/getting-direct-urls-for-azure-sentinel-incidents-using-kql/
The GA of the SecurityIncidents table will make this a lot easier.
