Alert - Get incident

[akefallonitis]

Hey,

I am trying to implement a Logic App with Alert - Get incident with an Azure Sentinel alert trigger and i get the following error when running:

{
  "error": {
    "code": 400,
    "source": "logic-apis-northeurope.azure-apim.net",
    "clientRequestId": "adc961ce-781a-406b-9f24-f02580e7f386",
    "message": "The response is not in a JSON format.",
    "innerError": "Invalid subscription id or resource group"
  }
}

As i validated all the parameters and permissions seem correct i dont know what i am doing wrong.

Anyone had any similar issue ?

[#2]

Actually i need to retrieve sentinel incidents using logic app can anyone share a way to do it ?

[#3]

@akefallonitis I just wrote a blog post on doing that.   Make sure to read Part 1 and 2 as I changed some of the ways I did the logic app in Part 2.   Part 3 gives you a workbook to start from that uses the data.

https://www.garybushey.com/2020/05/07/ingesting-azure-sentinel-incident-information-into-log-analyti...

[#4]

@Gary Bushey 

Hi Gary very nice!

Just one question what permissions the app needs to have to access and write the incidents ?

[#5]

@akefallonitis that was mentioned in the blog post:

One additional step you will need to take is to give this App the Azure Sentinel Reader rights at the some level. You can use either the Subscription, Resource Group, or Log Analytics workspace level and I would recommend the Log Analytics workspace level just for added security.

[#6]

@Gary Bushey 

Thanks again did not notice that. One last question the write to the log analytics does not require additional write permissions for the app ?

[#7]

@akefallonitis Strangely no.  I just the app the read permissions and it worked just fine.