Can't add playbook to incident automation of an analytics rule.

[basc0]

Hello,

whenever I add a playbook to the incident automation of an analytics rule i get this message after saving it:

The playbooks won't be added to the rule. Other actions like changing the status or assigning an owner are possible.

Does anyone know what the problem may be?

Thank you!

[#2]

I don't see where you would be able to add a playbook directly to an automation rule. In the "Automated response" tab you either add a rule to the "Alert automation" section or add an automation rule to the "Incident automation" section. I can also see where you can change the status but not assign an owner (that is only done once an Incident is created).

Can you provide some screenshots?

[#3]

@Gary Bushey 

Sure, here is a screenshot of what I'm trying to add.

And yes, I want to add it in the incident automation section.

It's also listed on the Review and update screen

But when I save the rule, I get the message from the OP, that it's only partially saved and the automation rule is gone.

 

[#4]

It sounds like you would need to open a ticket with Microsoft to get this resolved. In the meantime, can you create the same rule by going through Automation?

[#5]

@Gary Bushey I tried to add the playbook directly in the incident overview, like:

After saving, I got an actual error message:

 

Which is discussed here: https://techcommunity.microsoft.com/t5/azure-sentinel/azure-sentinel-automation-preview-issue-with-p...