Nov 23 2020
08:16 AM
- last edited on
Dec 23 2021
04:51 AM
by
TechCommunityAP
Nov 23 2020
08:16 AM
- last edited on
Dec 23 2021
04:51 AM
by
TechCommunityAP
Hi everyone!
I'm working with playbooks and we want to get a copy of every Incident created in Sentinel sent to a centralised location. I originally implemented this with every Alert that fired, but that does not give every Incident; the Incidents created from other Sentinel components (MCAS, O365, PIM, etc) do not have the ability to launch a playbook like a regular Analytics Rule.
I recently saw the following option for a Playbook Trigger:
However, I cannot figure out how to reference it within any Analytics Rule or anywhere within Sentinel! It does not seem to fire on its own when Incidents are created. How is this supposed to work?
Nov 23 2020 09:56 AM
@JKatzmandu This feature is still in private preview and, as far as I know, there is no official date for it to go to public preview. It is a bit confusing that the trigger shows up without being able to use it.
Nov 23 2020 11:03 AM
@Gary Bushey That's good to know. It is mentioned in documentation, but scantly. I'm back to running a query every 5 minutes against the "SecurityIncident" table to search for "New" incidents and then forwarding them via e-mail. I have a Condition that checks for the existence of the "IncidentUrl" string in the query results. If it's there, send the e-mail. If not, nada.
Dec 01 2020 08:12 AM