Forum Discussion
Sentinel alerts stopped running playbooks
I have at least four instances of Sentinel where the alerts create the incidents but don't run the associated playbooks. This seemed to have started somewhere around Dec 30th. There are no failed run...
I got the same issue and raised a ticket on 30/12. Triggering the playbooks manually from the incidents works as a work around. Been in touch with the support just now and it seems to be a general issue thats being worked on so MS is aware and working on it.
An interesting thing, I created a dummy playbook, assigned it to the alert and it worked. I switched back to the original playbook and now the alert triggers it.
AdiGrio That's odd.
So you assigned the alert the new dummy playbook and reassigned the alert the old playbook?
leoszalkowski That's correct, I assigned a new playbook, saved, reassigned the old playbook and it worked after that. In fact you can just remove the existing playbook, save, and then reassign, no need for a "temporary" one. The problem is that I would have to do that for every alert configured. We have hundreds of them so I would rather not go that path.
