Run Playbook Action Blank Automation

[superjay]

Hey All, 

When I select action the then Run Playbook, see screenshot, it get no available items, anyone else had this?

[#2]

Do you have any Playbooks configured with the Incident trigger? Do you have Logic App Contributor permission on the Logic Apps?

[#3]

Hi,

I do have two of them linked to incidents, the rest are not. The account I'm using has owner level permissions.

[#4]

Could you provide an overview of your Logic App? A screenshot of the top part?
The trigger should be When Azure Sentinel incident creation rule was triggered

[#5]

Sure the attached is from the github playbook that we use to run an IP check against anonymous  IP Alerts @Thijs Lecomte 

[#6 · Accepted solution]

What is the first step? I think you are using a Playbook which should be triggered by an alert, instead of an incidents.

Incident based Playbooks needs to be configured through automation rules
Alert based Playbooks through the Analytics Rule configuration (in the automation tab)
https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook#respond-to-alerts

[#7]

Yep that's solved it, made a test rule and change the triggering to Azure Sentinel Incident (Preview) thanks so much :)