Forum Discussion
Email data parsing
Hello, recently I was trying to get data of my azure sentinel alerts on my email using playbook but the main issue is how to get the desired field in the email.
- Have you tried using the 'Parse JSON' in Logic Apps and giving it the output of the 'A new Sentinel Event is created'?
This will enable you to use the different fields really easy in next steps - YanivSh
Microsoft
Also we can add @Jon Nordström azure function that is more cost effective and tested in large scale
https://github.com/OfficeDev/O365-ActivityFeed-AzureFunction/tree/master/Sentinel/msgtrace
here is the data schema
Does this means you guys recommend using Functions instead of Logic Apps?
- YanivSh
Thijs Lecomte this is two different method that works with the same exchange API.
if dealing with transferring a lot of data, function will be more cost effective.
logic app has its own advantages, like debugging.
