Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community

Playbook (Logic App) - trigger - When Azure Sentinel incident creation rule was triggered

Copper Contributor

Hi

 

i am attempting to use the trigger "When Azure Sentinel incident creation rule was triggered"  that's in preview.

 

but the playbook is not triggered even if i know that i have a new incident in Sentinel 

 

what's missing from the configuration? 

30 Replies

@erlendoyen You are probably not going to get much help here as, like you said, the feature is in private preview and we are unable to discuss it.  There should be some email addresses in the preview documents that you can use to ask for assistance.

 

Hm, I have not applied for a private priview so I assumed it's public preview now?

@erlendoyen I think what is happening is the Incident trigger is showing up when creating Playbooks but you still need to be part of the private preview to use it.  I am trying to get verification of this and if I am wrong I will let you know.

Aha, ok where can I sign up for the private preview? Any idea on when it will be public?

@erlendoyen Go to Analytics and click the alert rule that you want to get alerted on and edit it. The rule type has to be scheduled for you to be able to trigger the playbook. Go to automated response type and select the playbook/logic app that you created and save it. 

It's kind of confusing but you will have to do it for every alert rule and it doesn't do it for every rule automatically as the logic app suggests.

@Ofer_Shezaf Is this the only option to trigger a playbook against an incident? 

sammyredo_0-1602787993091.png

 

The first option which I am able to use Only triggers against generated alerts.

Is there any other option you know of, if I want to trigger a playbook with an Incident?

As mentined, the second one, which is what you need, is in private preview.

@erlendoyen 

 

Private previews tend to move pretty fast with Sentinel. Worth the wait on the new activity.

 

If you need something sooner you can schedule a query against the incidents table using the "Run query and list results" activity.  https://azurecloudai.blog/2020/09/23/sentinel-email-notification-logic-app/ 

@erlendoyen If you have a Microsoft NDA, you can sign up for our preview program at www.aka.ms/SecurityPrP 

Anyone know when this will be publicly available?

When can we expect this working. Even the private previews doesn't work. Microsoft failed in delivering this again ?

@PrashTechTalk  : I am not aware that the private preview does not work. That said, the feature will be supported as part of a larger motion to enhance Sentinel automation, called automatoin rules, which is entering private preview as we speak.

@Ofer_Shezaf - Playbook is not listed at the automated response section of the analytics rule (when in edit).  Tenant is registered for private preview but sadly none of the playbook using new trigger displays in the automated response list. 

What is the GA date for this feature in logic apps? Is there anybody who is aware of this?

 

It was announced at Ignite it would turn public preview soon
https://techcommunity.microsoft.com/t5/azure-sentinel/microsoft-ignite-2021-what-s-new-in-azure-sent...
No news has been out when it will become available in our subscriptions
Started rolling out gradually to public preview today. Should be 100% rolled out in two weeks.

This great feature is on GA, now !!!

 

Thank you !!

Regards

Hi everyone,
Do these logic apps/playbooks still need to be attached to every single analytics rule?
I'd like to create a 'global' playbook to add contextual information to every incident.
eg. apply MITRE SHIELD information to every incident's comment section.
I'm not eager to go to all 300 analytic rules and assign a playbook.