Jan 03 2020 06:30 AM
Jan 03 2020 06:30 AM
I have at least four instances of Sentinel where the alerts create the incidents but don't run the associated playbooks. This seemed to have started somewhere around Dec 30th. There are no failed runs for the logic apps, and if I trigger the playbook from the incident detailed view, it works without any problem.
I have scheduled logic apps (using the Recurrence trigger) and they work fine but those that are supposed to be triggered by an Azure Sentinel alert are not running even though there are alerts raised.
I opened a ticket with Microsoft but I didn't receive any reply so far.
Jan 03 2020 07:31 AM
Also having the same issue across 3 tenants. Problem started for us around 9am EST on the 31st.
I can run them manually within the Incident details page, but triggers are failing if I run them in the Logic App page.
After some digging around in the logic app code, I looked at the raw output of the block that's failing I found that the header is not populating correctly and the body is not populating at all.
Jan 03 2020 07:39 AM - edited Jan 03 2020 07:44 AM
@leoszalkowski I've seen your post and the problem looks quite similar.
The playbook would not work if one triggers the "Sentinel Alert" manually because is missing the data from the alert itself. For this reason, when used from the Incident details interface, the playbook works because it is receiving the alert details.
I don't think this is a problem with the playbooks as they are not showing with failed runs. Most likely is an issue with the Azure Sentinel Logic App trigger (that's still in Preview mode). I will create a new playbook from scratch and see if it makes any difference.
Jan 03 2020 08:29 AM
Jan 03 2020 09:58 AM
An interesting thing, I created a dummy playbook, assigned it to the alert and it worked. I switched back to the original playbook and now the alert triggers it.
Jan 03 2020 02:04 PM
@leoszalkowski That's correct, I assigned a new playbook, saved, reassigned the old playbook and it worked after that. In fact you can just remove the existing playbook, save, and then reassign, no need for a "temporary" one. The problem is that I would have to do that for every alert configured. We have hundreds of them so I would rather not go that path.
Jan 05 2020 01:53 AM
Apr 28 2020 11:34 AM
Have you heard anything? I'm have the same problem. The playbook runs manually from sentinel incidents page but doesn't trigger on new alerts. I need it to trigger since this logic app is for notification of new incidents. Any insight would be appreciated
Apr 28 2020 12:22 PM
As a test, I suggest that you delete and recreate the alert to see if it makes any difference. In some situations it appears that the "sync" between the alert and the playbook (aka an "action") is lost or misconfigured so you may have a situation where an alert may look like is assigned to a playbook but in reality is not. This could also cause the opposite of not running playbooks, when the playbook is ran several times. That again we found out was due to the alert having several "actions" for the same playbook (the Sentinel "actions" are only accessible throught the API).