Forum Discussion
Sentinel alerts stopped running playbooks
Also having the same issue across 3 tenants. Problem started for us around 9am EST on the 31st.
I can run them manually within the Incident details page, but triggers are failing if I run them in the Logic App page.
After some digging around in the logic app code, I looked at the raw output of the block that's failing I found that the header is not populating correctly and the body is not populating at all.
leoszalkowski I've seen your post and the problem looks quite similar.
The playbook would not work if one triggers the "Sentinel Alert" manually because is missing the data from the alert itself. For this reason, when used from the Incident details interface, the playbook works because it is receiving the alert details.
I don't think this is a problem with the playbooks as they are not showing with failed runs. Most likely is an issue with the Azure Sentinel Logic App trigger (that's still in Preview mode). I will create a new playbook from scratch and see if it makes any difference.
AdiGrio You're probably right. That's probably why the raw output of the trigger block isn't populating properly.