Forum Discussion

leoszalkowski's avatar
leoszalkowski
Brass Contributor
Dec 30, 2019
Solved

Sentinel Playbook Issue

I have a set of playbooks to run automatically when an incident is created from an alert. So far it's been working well without issues, until today.   The playbook hasn't been running for the alert...
  • leoszalkowski's avatar
    leoszalkowski
    Dec 31, 2019

    leoszalkowski I discovered today that our subscription was impacted by a Log Analytics disruption yesterday between 00:28 and 04:04 UTC. That is around the time the playbooks have stopped working, and are still being impacted.

Rod_Trent's avatar
Rod_Trent
Icon for Microsoft rankMicrosoft
Dec 31, 2019

leoszalkowski 

 

What error notification do you receive when the Trigger fails to run? Anything?

leoszalkowski's avatar
leoszalkowski
Brass Contributor
Dec 31, 2019

I get the 404 Not Found on the Get Incident block of my logic app.

 

When I try to diagnose the issue using the Logic App Diagnose and Solve Problems tool, I get this error:

 

"The detector couldn't identify the subscription, resource group or workflow specified in the URL. Please check your link."

 

  • leoszalkowski's avatar
    leoszalkowski
    Brass Contributor
    Jan 02, 2020

    Quick update.. (still no solution)

     

    I did some more digging into this issue. Within the playbook error, it's looking like the playbook block that's throwing the error is not getting the correct output. 

     

    I went back through the run history and noticed the raw outputs are drastically different. It is receiving different header information and no body information.

     

     

Resources