Forum Discussion

JKatzmandu's avatar
JKatzmandu
Brass Contributor
Nov 23, 2020

Playbook Triggering

Hi everyone!

 

I'm working with playbooks and we want to get a copy of every Incident created in Sentinel sent to a centralised location. I originally implemented this with every Alert that fired, but that does not give every Incident; the Incidents created from other Sentinel components (MCAS, O365, PIM, etc) do not have the ability to launch a playbook like a regular Analytics Rule.

 

I recently saw the following option for a Playbook Trigger:

 

 

However, I cannot figure out how to reference it within any Analytics Rule or anywhere within Sentinel! It does not seem to fire on its own when Incidents are created. How is this supposed to work?

  • GaryBushey's avatar
    GaryBushey
    Bronze Contributor

    JKatzmandu This feature is still in private preview and, as far as I know, there is no official date for it to go to public preview.  It is a bit confusing that the trigger shows up without being able to use it.

     

     

    • JKatzmandu's avatar
      JKatzmandu
      Brass Contributor

      GaryBushey That's good to know. It is mentioned in documentation, but scantly. I'm back to running a query every 5 minutes against the "SecurityIncident" table to search for "New" incidents and then forwarding them via e-mail. I have a Condition that checks for the existence of the "IncidentUrl" string in the query results. If it's there, send the e-mail. If not, nada.

      • pemontto's avatar
        pemontto
        Brass Contributor
        Also doing the same but with one analytic per severity. Can't wait until this has a first class solution!

Resources