E-mail Alert Upon Creation of New Incident

[mleung]

I would like to set-up the following: 

1) Email alerts any time a new incident is auto generated "Create incidents based on all alerts generated." template.

I've tried using the "When a response to an Azure Sentinel alert is triggered" step in Logic App, and it would work if I got to the incident and click "Run Playbook".  However, when new incidents pop up, the playbook isn't triggered.  Is there something I am missing?

[#2]

The playbook will not run because Sentinel doesn't want to automatically run playbooks if you don't specify it in the analytic rule.

If the incident/alert is automatically created then you can make a analytic rule and query to filter on a specific incident/alert and then check mark that specific playbook you created.

Now that the analytic rule is created, it will trigger the playbook based on the query parameters you specified.

[#3]

As @TeachJing mentions, the Analytics Rule must be modified to include the Playbook on the Automated Response tab (shown below).

Add automation

[#4]

This scenario has now been made considerably easier with the use of Automation Rules.

https://docs.microsoft.com/en-us/azure/sentinel/automate-incident-handling-with-automation-rules

No longer do you have to set the automation action on every analytic rule, but you can now also get email notifications for incidents generated by all rule types (Fusion, Microsoft Security and ML Behaviour Analytics).

Just remember you will have to amend the playbook trigger to "When Azure Sentinel incident creation rule was triggered"