Forum Discussion
How to use 'When Azure Sentinel incident creation rule was triggered' trigger in playbook
Hi team
I have been wondering can this trigger 'When Azure Sentinel incident creation rule was triggered' be used??
I am unable to select the playbook having this trigger in any alert rule created under Azure Sentinel analytics.
Can someone please help me out with this.
I just want a playbook to be triggered using this trigger and post the incident details to Slack
Hi,
I have the same problem. I have been trying to set incident e-mail notifications during many days but never have achieved the desired result.
If you set the alert starting with "When a repsonse to an Azure Sentinel alert is triggered" the dynamic options they give you are so poor. You can not add the incident URL (which I think it is so basic!) and also if you want to see IP and users you have to parse with JSON format and take that values from there. But the result it is not the desired because the IP and users, Azure Sentinel treat them as individual entities so it is impossible to take them with some logic (for example, something so basic: IP 10.10.10.10 with USER Federico). Moreover, if you do something like this you will receive as many e-mails as entities appear in the alert!
On the other hand, if you put this in a dynamic HTML table, then the table also won't have much sense because will appear the entities with no relation too.
The next step I have tried is about alert type "When Azure Sentinel incident creatin rule was triggered". Here it seems they provide you with more dynamic options (url from incident, IP, users...), it seems this option has all what I need (and probably what most users need) but this alert does not work fine! If you go to an incident and try to execute this playbook is as simple as this playbook does not appear!
Microsoft please, do something about all this, it has no sense at all. And lot of clients are "playing" and using Azure Sentinel because it is suposed to be a nice product. But not for now.
uditk14 Since this feature is part of a private preview, you would probably have better luck using the form or the Email addresses to get assistance with this.
I am facing the same problem. Just to confirm, while I am with (Private View only), I am unable to use in the Sentinel? It is?
Do you have any indication not to send email when the alert is created, but an incident is already open and the alert is grouped for that incident?
I am getting created creation emails, but they are being grouped together in the same incident, so they are not considered new incidents for dealing with time.
As the e-mail is sent for ticket management, more than one incident is created, however, no new incidents were created, rather, alerts grouped in the same incident.
I would be grateful for some kind of help.
