Forum Discussion

ryanksmith's avatar
ryanksmith
Copper Contributor
Sep 13, 2019

Azure Sentinel Logic App write back to comment

Hi All,   I am trying to write the output of a HTTP GET (Which works) to a comment  in Sentinel, from my review it appears as if the ID's and Groups are set correctly but I am getting a Bad Request...
GaryBushey's avatar
GaryBushey
Bronze Contributor
Oct 01, 2019

ryanksmith can you show your settings for "Add comment to incident"?   BTW, I get an error on this action after creating a Service Now ticket so I think there is definitely some sort of but in there.

ryanksmith's avatar
ryanksmith
Copper Contributor
Oct 01, 2019

GaryBushey  - yes here is how I have it setup:  

  • GaryBushey's avatar
    GaryBushey
    Bronze Contributor
    Oct 01, 2019

    ryanksmith I'm beginning to think there is a bug where anything that is not static text in the "Specify incident comment" throws an error.   Plan on looking into this a bit more tomorrow.

    • ryanksmith's avatar
      ryanksmith
      Copper Contributor
      Oct 01, 2019

      GaryBushey  - Looks like our errors are exactly the same, your bang on, static works fine something about the input throws it off 

      • GaryBushey's avatar
        GaryBushey
        Bronze Contributor
        Oct 03, 2019

        ryanksmith FYI, I am working ( or at least I provided them with my test cases) with someone from MS in regards to this issue.  What I have found is that if you use the comment feature without any dynamic content it works fine.  Once you have it use dynamic content it stops working and the only way to get it back is to delete the entire logic app and recreate it.

         

        More updates as I get them