Alert - Get incident

Question

Hey,I am trying to implement a Logic App with Alert - Get incident with an Azure Sentinel alert trigger and i get the following error when running:&nbsp;&nbsp;{
  "error": {
    "code": 400,
    "source": "logic-apis-northeurope.azure-apim.net",
    "clientRequestId": "adc961ce-781a-406b-9f24-f02580e7f386",
    "message": "The response is not in a JSON format.",
    "innerError": "Invalid subscription id or resource group"
  }
}&nbsp;As i validated all the parameters and permissions seem correct i dont know what i am doing wrong.Anyone had any similar issue ?&nbsp;

garybushey · Answer

akefallonitis&nbsp;I just wrote a blog post on doing that.&nbsp; &nbsp;Make sure to read Part 1 and 2 as I changed some of the ways I did the logic app in Part 2.&nbsp; &nbsp;Part 3 gives you a workbook to start from that uses the data.&nbsp;https://www.garybushey.com/2020/05/07/ingesting-azure-sentinel-incident-information-into-log-analytics/

akefallonitis · Answer

Actually i need to retrieve sentinel incidents using logic app can anyone share a way to do it ?

akefallonitis · Answer

GaryBushey&nbsp;&nbsp;Hi Gary very nice!&nbsp;Just one question what permissions the app needs to have to access and write the incidents ?

garybushey · Answer

akefallonitis&nbsp;that was mentioned in the blog post:&nbsp;One additional step you will need to take is to give this App the Azure Sentinel Reader rights at the some level. You can use either the Subscription, Resource Group, or Log Analytics workspace level and I would recommend the Log Analytics workspace level just for added security.

akefallonitis · Answer

GaryBushey&nbsp;&nbsp;Thanks again did not notice that. One last question the write to the log analytics does not require additional write permissions for the app ?

Forum Discussion

Alert - Get incident

Share

Resources