Forum Discussion
Extracting Additional Data for E-mail Alert via Playbook
I have a logic app setup to be used for email alerting with one of my scheduled queries. I am able to pull out the entity data such as Account, Host, IP, etc., but is there a way to pull out other sets of data as well?
For example, my email alert will provide be with the mapped entities mentioned above, but I have additional fields that display data that I need in my email alert as well, is it possible to extract this in the Sentinel connector?
Thanks,
Sean
pho30 I did something similar with one of my logic apps. I had to create custom expressions using "triggerbody()?" in order to extract some of the other fields.
This link may be helpful: https://docs.microsoft.com/en-us/azure/logic-apps/workflow-definition-language-functions-reference
leoszalkowski GaryBushey Appreciate the responses, will look into both. Thanks!
- Hi Sean,
Have you managed to resolve this, and if so, do you mind sharing your steps?
pho30 What you see in the list of dynamic content is everything that the Azure Sentinel connector will return. If you have additional fields you would like to be available I would suggest creating a new entry in the Azure Sentinel feedback page at: https://feedback.azure.com/forums/920458-azure-sentinel
With that being said, you can may REST calls inside of Playbooks where you can get more information from the unsupported (so far) Azure Sentinel REST API located at https://github.com/Azure/azure-rest-api-specs/tree/master/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2019-01-01-preview
Wortell has created some great PowerShell commands using this API that you could use as a basis for your calls. They are located at https://github.com/wortell/AZSentinel
Hope this helps
pho30 Hi Sean, apart from the pre-defined values you can add other values by parsing the JSON parameter. All the parameters in the alert are to be converted into string. I've used this logic in my case. "Everytime an alert is triggered, using data operations connectors click on parse json, take the predefined value available in the alert For eg: "Extended properties" or "Entities" and click on sample payload to generate sample schema. From the logs copy the exact parameter and paste it in the sample schema, it will automatically generate a new schema for you. You can then make use of these values as per your requirement to either send an email or create a ticket in SNOW.
Hope this helps!!
