Alert - Get incident Error when attempting to Auto Remediate Cloud App Security Alerts

[Hogank]

Following the creation of a LogicApp to auto remediate Cloud App Security alerts, I receive the following error for the Alert - Get incident: 

{

    "statusCode": 404,

    "headers": {

        "Access-Control-Allow-Methods": "GET, PUT, PATCH, DELETE, POST",

        "Access-Control-Allow-Origin": "*",

        "Access-Control-Max-Age": "3600",

        "Access-Control-Expose-Headers": "*",

        "Date": "Thu, 11 Mar 2021 15:35:46 GMT",

        "Content-Length": "54",

        "Content-Type": "application/json"

    },

    "body": {

        "statusCode": 404,

        "message": "Resource not found"

    }

}

Does anyone have any idea why this might be occurring? I followed the instructions from this Playbook for Azure Sentinel & MCAS integration | by Priscila Viana | Medium Thank you in advance!

[#2]

Hi

Could you share what you are providing as input in the Get Incident step?

Just double checking: There is an incident for this alert (viewable from the GUI?)

[#3]

The following is the input:

{
"method": "get",
"path": "/Incidents/subscriptions/9836142a-7fce-4366-a0fb-c969265b1153/resourceGroups/East-Prod-Sentinel-RG/workspaces/246cb7e4-8c78-4ba8-a725-3db560777362/alerts/",
"host": {
"connection": {
"name": "/subscriptions/9836142a-7fce-4366-a0fb-c969265b1153/resourceGroups/East-Prod-Sentinel-RG/providers/Microsoft.Web/connections/azuresentinel"
}
}
}

And yes!

[#4]

Anything?

[#5]

Can you share the details of that step.
This is my code for my Get-Incident
"Alert_-_Get_incident": {
"inputs": {
"host": {
"connection": {
"name": "@parameters('$connections')['azuresentinel']['connectionId']"
}
},
"method": "get",
"path": "/Incidents/subscriptions/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/resourceGroups/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/workspaces/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/alerts/@{encodeURIComponent(triggerBody()?['SystemAlertId'])}"
},
"runAfter": {},
"type": "ApiConnection"
},


I don't think you are passing the right parameters within your Get-Incident action