Forum Discussion

ryanksmith's avatar
ryanksmith
Copper Contributor
Sep 13, 2019

Azure Sentinel Logic App write back to comment

Hi All,   I am trying to write the output of a HTTP GET (Which works) to a comment  in Sentinel, from my review it appears as if the ID's and Groups are set correctly but I am getting a Bad Request...
ryanksmith's avatar
ryanksmith
Copper Contributor

 

Have moved the get Incident blade around, still get the same 400 error

 

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>Bad Request</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>
<BODY><h2>Bad Request - Invalid URL</h2>
<hr><p>HTTP Error 400. The request URL is invalid.</p>
</BODY></HTML>

GaryBushey's avatar
GaryBushey
Bronze Contributor
Oct 01, 2019

ryanksmith can you show your settings for "Add comment to incident"?   BTW, I get an error on this action after creating a Service Now ticket so I think there is definitely some sort of but in there.

  • ryanksmith's avatar
    ryanksmith
    Copper Contributor
    Oct 01, 2019

    GaryBushey  - yes here is how I have it setup:  

    • GaryBushey's avatar
      GaryBushey
      Bronze Contributor
      Oct 01, 2019

      ryanksmith I'm beginning to think there is a bug where anything that is not static text in the "Specify incident comment" throws an error.   Plan on looking into this a bit more tomorrow.

      • ryanksmith's avatar
        ryanksmith
        Copper Contributor
        Oct 01, 2019

        GaryBushey  - Looks like our errors are exactly the same, your bang on, static works fine something about the input throws it off 

Resources