How to reference custom details from Alert Enrichment in Logic Apps - Sentinel

%3CLINGO-SUB%20id%3D%22lingo-sub-2560691%22%20slang%3D%22en-US%22%3EHow%20to%20reference%20custom%20details%20from%20Alert%20Enrichment%20in%20Logic%20Apps%20-%20Sentinel%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2560691%22%20slang%3D%22en-US%22%3E%3CDIV%20class%3D%22msla-card-title%22%3EWhen%20a%20response%20to%20an%20Azure%20Sentinel%20alert%20is%20triggered%2C%20I%20want%20to%20reference%20the%20custom%20details%20from%20the%20Alert%20Enrichment%20of%20the%20Analytical%20Rule%20alert%20I%20have%20configured%2C%20in%20my%20Logic%20App%20playbook%20automated%20response.%20It%20looks%20as%20though%20I%20need%20an%20expression%20to%20pull%20the%20information%20but%20I'm%20not%20sure%20what%20the%20expression%20is.%3C%2FDIV%3E%3C%2FLINGO-BODY%3E
Established Member
When a response to an Azure Sentinel alert is triggered, I want to reference the custom details from the Alert Enrichment of the Analytical Rule alert I have configured, in my Logic App playbook automated response. It looks as though I need an expression to pull the information but I'm not sure what the expression is.
0 Replies