Forum Discussion
SNOW Logic App Connector
Is it possible to generate SNOW tickets to the "Events" table as opposed to the the "Incidents" table using the built-in Logic App connector?
6 Replies
- AndrewBlumhardt
Microsoft
Use the SNOW playbook in the repo as an example. You can trigger using a log analytics query. Here is a similar example. https://secureinfra.blog/2020/09/23/sentinel-email-notification-logic-app/AndrewBlumhardt I was using the playbook from the repo as a template. This question is more of a question on the SNOW side than Sentinel.
The way our SNOW works is that when a "ticket" comes in it starts in the Event table so that it can begin automated correlation then moves to the Alert table and then to the incident table.I saw the Event table in the SNOW connector parameters, however there was issues with the playbook failing to run. But when I changed it to send to the Incidents table, it worked without issue.
leo_szalk The only Event table in Azure Sentinel holds the Windows Events that you get from using the Microsoft Monitoring Agent. Not sure what the SNOW connector is referring to.
