Forum Discussion

ss1247's avatar
ss1247
Copper Contributor
Jul 07, 2020

Playbook to have more details when alerted as email

I have a playbook designed for the Azure Sentinel Alert but when the playbook is executed the email is sent with Alert display name    How to get the Event count, User ID and Link to Azure Sentinel...
Rod_Trent's avatar
Rod_Trent
Icon for Microsoft rankMicrosoft
Jul 07, 2020

ss1247 We're working on that and have a new SecurityIncident table in Private Preview that will solve what you're looking for. You can join the private preview program for Azure Sentinel at the following link:

https://forms.office.com/Pages/ResponsePage.aspx?id=v4j5cvGGr0GRqy180BHbR-kibZAPJAVBiU46J6wWF_5URDFSWUhYUldTWjdJNkFMVU1LTEU4VUZHMy4u

 

In the interim, you can get this information through the API, but also it's available by digging in and doing some additional parsing in your queries. Here's an example of getting the Incident URL:  

 

https://secureinfra.blog/2020/06/11/getting-direct-urls-for-azure-sentinel-incidents-using-kql/ 

 

The GA of the SecurityIncidents table will make this a lot easier.