Include Additional Entities Detail in Email

[DGMalcolm]

Hey all,

I am relatively new to Sentinel and I've run across a situation I can't seem to resolve. I've enabled the "SentinelIncident" automation rule and I've configured it to run the 'Send-email-with-formatted-incident-report' playbook. I am receiving the emails when incidents happen but the emails are missing some important details. For example, I occasionally get an email entitled " New Azure Sentinel incident - Atypical travel". In the Entities box at the bottom of this email there are 2 columns - Entity and Entity Type. For this type of incident the Entity column shows a GUID with an Entity Type of Account. Can I resolve the GUID to a user name or UPN so that it shows in the email? Without the user name I have to log into Azure to find out which user is responsible for the incident.

Related but probably more advanced, is there a way to give a geolocation for the IP addresses that also show in the Entities box. It would be helpful to know where the Atypical Travel was happening.

TIA

~dgm~

[#2 · Accepted solution]

Two options:

1. You can amend the Playbook to run a new KQL query to do the UPN lookup and geo lookup https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/geo-info-from-ip-address-function
2. You can disable the atypical travel alert with an Automation Rule, then write run your own version of Atypical travel with all the enrichments you need and call the playbook from that

[#3]

Great, thank you for the guidance. I'm digging into these options now.

[#4]

I went off to begin digging into these details but then got sidetracked by other things, you know life. And now I've come back to this. I've got queries that pull the geolocation info and I am able to get the UPN data. But I'm not sure how to "amend the Playbook to run a new KQL query". I don't see an option in the Playbook editor for running a KQL query - am I just missing something?

[#5]

@DGMalcolm 

Press the "New step " button in the Playbook Editor then type in a search for "Run Query"

[#6]

@Clive_Watson

Okay, maybe it's not just me being a dummy. I tried using that step but the 'Subscription' field doesn't populate. I figured that it wasn't licensed on my subscription somehow. Guess I need to figure out what's causing this then.

[#7]

@DGMalcolm 

Have you tried making sure you're not filtering out any subsciptions in the portal settings?

[#8]

@MicahFalde 

Thought that might be it for a moment or two - when I looked at the settings it was filtered to 1 subscription. However, I changed the filter to All Subscriptions and the Subscription field still shows "Loading..." for 1-2 seconds then says 'No Items'. I logged out and back in to ensure it wasn't related to the session. Still nothing.

[#9]

@DGMalcolm 

It can depend what Subscription you need.  If its the Sentinel Workspace one, that is available as "Dynamic content" - search for "Subscription" in the box that pops up when you click on the Subscription field 

[#10]

@Clive_Watson 

Thank you with for your help with this. It definitely got me a couple steps closer. I still find myself hunting for the options I need. Is there a Logic Apps dev guide or learning resource someplace? I've looked and can only seem to find the standard MS Docs which don't really give me enough detail.

TIA

~dgm~

[#11]

There are loads of resources on Learn (which I think you've seen) especially in the reference section: https://learn.microsoft.com/en-us/azure/logic-apps/logic-apps-overview

Pluralsight and Udemy (and others) have courses, but I've not done them so dont have a recommendation.

Module 9 of https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-ninja-the... will also help - with a video

[#12]

@Clive_Watson 

Once again, thank you for the help. I'll dig around in this and see if there are some answers.

TY

~dgm~