Forum Discussion

ryanksmith's avatar
ryanksmith
Copper Contributor
Sep 13, 2019

Azure Sentinel Logic App write back to comment

Hi All,   I am trying to write the output of a HTTP GET (Which works) to a comment  in Sentinel, from my review it appears as if the ID's and Groups are set correctly but I am getting a Bad Request...
GaryBushey's avatar
GaryBushey
Bronze Contributor
If you are still having issues, look at my thread on writing comments. Nicholas gave me all the steps needed to get it to work there.
ryanksmith's avatar
ryanksmith
Copper Contributor
Sep 27, 2019

Thanks, GaryBushey   Yes checked that, and ensured I have the Get Incident Blade as per Nicholas DiCola (SECURITY JEDI) Wondering if its an issue with my  "For Each"  will play with the order and see if that fixes it will post if successful

  • ryanksmith's avatar
    ryanksmith
    Copper Contributor
    Oct 01, 2019

     

    Have moved the get Incident blade around, still get the same 400 error

     

    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">
    <HTML><HEAD><TITLE>Bad Request</TITLE>
    <META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>
    <BODY><h2>Bad Request - Invalid URL</h2>
    <hr><p>HTTP Error 400. The request URL is invalid.</p>
    </BODY></HTML>

    • GaryBushey's avatar
      GaryBushey
      Bronze Contributor
      Oct 01, 2019

      ryanksmith can you show your settings for "Add comment to incident"?   BTW, I get an error on this action after creating a Service Now ticket so I think there is definitely some sort of but in there.

      • ryanksmith's avatar
        ryanksmith
        Copper Contributor
        Oct 01, 2019

        GaryBushey  - yes here is how I have it setup:  

Resources