Forum Discussion
Creating a playbook with actionable message for end users
Hi, Has anyone tried to create a playbook in Sentinel with workflow to send an actionable message to the end user to get them to confirm if they completed an action which triggered an alert/incid...
The one I saw was all done from within the Playbook using a condition check - one example
1. If Alert fires - "send email to user" + lookup and "email manager", else "do nothing" (I think they actually wrote the state to a Teams channel at the time, plus "updated" the Incident.
2. Then the task waits for the user / manager to respond
I dont recall if they had your "wait 1 hr" accounted for. It was at least 3years ago!
Good luck with this, I suspect most users wont reply within the time window you set, without some training or penalty
Thanks Clive.