Azure Sentinel playbook Get-incident fails with bad gateway

Occasional Contributor

This is how my Get-incident looks like 


And when i try to run it i get this error:

  "error": {
    "message""The response is not in a JSON format.",
    "innerError""Invalid subscription id or resource group"


I have tried to write subscription id and resource group manual, no difference.

anyone have any fix for this?



7 Replies
Have you double checked that the subscription ID and resource group is correctly filled in when you check the run history?

@Thijs Lecomte 

Yes, checked it

I also tried to put them in manually, still the same result

best response confirmed by mircasa (Occasional Contributor)
Does the account you connected with have permissions on the Sentinel instance?

@Thijs Lecomte 

im asuming it has.


Its a service account which was made for azure sentinel.

but i didnt create it.


Where i can i check if it has the correct permissions?

if its in Azure ad in Assigned Roles, it has Global Administrator

@Thijs Lecomte 


Nevermind, found it.


I think it got solved after i added the sentinel role to the User.


Thank you for you help! :)

Glad you found it
BTW: I would advise against a service account.
But instead use a service principal to authenticate against sentinel

@Thijs Lecomte 


I will look into that,