Forum Discussion

GaryBushey's avatar
GaryBushey
Bronze Contributor
Sep 23, 2019
Solved

Azure Sentinel Logic App Action Incident ID

I am looking at the Azure Sentinel action in Logic Apps (AKA Playbooks) and I notice that when I try to do something like "Add a Label" or "Write a Comment" most of the fields (Subscription ID, Resou...
GaryBushey's avatar
GaryBushey
Bronze Contributor
Sep 26, 2019

   That did the trick.  I must have looked at the list of possible variables a dozen time and missed it every time!   Thanks for all of your help!

ryanksmith's avatar
ryanksmith
Copper Contributor
Sep 30, 2019

GaryBushey   Are you able to post a screencap of what your add comment blade looks like?  still can't get mine to work.

  • ryanksmith's avatar
    ryanksmith
    Copper Contributor
    Oct 22, 2019

    GaryBusheydid you ever get this to work,  can get it to write static comments but that's it.

    • GaryBushey's avatar
      GaryBushey
      Bronze Contributor
      Oct 24, 2019

      ryanksmith I just tried this again and I was NOT able to get it to work yet.

      • Molx32's avatar
        Molx32
        Brass Contributor
        Nov 06, 2019

        Any update of the topic ? I just had the same HTTP 400 mentionned above

         

        Here is my Playbook

        1. Sentinel input
        2. Mail approval
          1. Approved: post message on Teams --> It works
          2. Refused: close the incident --> Same error as GaryBushey
    • Gary Bushey's avatar
      Gary Bushey
      Copper Contributor
      Oct 22, 2019

      ryanksmith I have not tried it recently but when I checked last time MS was working on a fix.