Problems with Playbooks - Request Header Fields Too Large

[DKlom]

Hi all,

Since this afternoon my Playbooks are not working anymore.

I have a few Playbooks that are being triggered by Automations Rules.

The first step in the Playbook is the Sentinel Incident Trigger.

Second step is the "Get Incident" which gets the incident details with the Incident ARM ID from step 1.

The second step is not working anymore and I get with every Playbook "Status Code: 431" and as output:

{

  "StatusCode": 431,

  "ReasonPhrase": "Request Header Fields Too Large",

  "Content": "",

  "Headers": {

    "Pragma": [

      "no-cache"

    ],

The same error happens with a Playbook where I add a comment to the Incident.

Status code is also 431 and stops the Playbook.

Anybody any solution/help to fix this?

Thanks in advance!

[#2]

We are seeing the same problems. Any playbook that tries to add a comment or tag is failing with that error. Fortunately these actions are at the end of the playbook so most of the important actions are done. But it is causing some issues. 

[#3]

Thanks for your reply!

Good to hear that I’m not the only one, but unfortunately for you you have the same problem.

I hope they fix it soon, as some playbooks are really needed for us to respond to incidents.

Online I cannot find anything about a bad health state for Azure or other products.

Which region are you in?

[#4]

Seems to be working again

[#5]

I have seen the same exact errors yesterday.
Suddenly it fixed itself.

And now, it looks like its broken again, at least in some tenants

[#6]

@SimonRef 

We are seeing the same, issues are back, seems to start after 11:30 UTC both yesterday and today. Our setup is in Europe West. 

[#7]

We also use WestEU only.
I have created an issue with MS, and is waiting for response.

[#8]

@SimonRef & @Crayon_Dan 

Thanks for the replies!

indeed, here also again.

This morning still working fine, and now they stop again.

maybe it’s West Europe related as we all have the same region?

Hope there will be a permanent fix soon as this gets annoying😅

[#9]

Hello,
I am also located in West Europe and as of today i continue to see the problem coming up since May 31.
For me it appears in the actions for sentinel:
-Update incident
-Get Incident
-Add comment to incident
Similar to other comments, this are not critical actions for us, but are becoming very problematic.