Nov 23 2020
- last edited on
Dec 23 2021
I'm working with playbooks and we want to get a copy of every Incident created in Sentinel sent to a centralised location. I originally implemented this with every Alert that fired, but that does not give every Incident; the Incidents created from other Sentinel components (MCAS, O365, PIM, etc) do not have the ability to launch a playbook like a regular Analytics Rule.
I recently saw the following option for a Playbook Trigger:
However, I cannot figure out how to reference it within any Analytics Rule or anywhere within Sentinel! It does not seem to fire on its own when Incidents are created. How is this supposed to work?
Nov 23 2020 11:03 AM
@Gary Bushey That's good to know. It is mentioned in documentation, but scantly. I'm back to running a query every 5 minutes against the "SecurityIncident" table to search for "New" incidents and then forwarding them via e-mail. I have a Condition that checks for the existence of the "IncidentUrl" string in the query results. If it's there, send the e-mail. If not, nada.