Sentinel Playbooks Logic Apps

[idontknowanything]

Hello,

I'm creating a playbook for some of the alerts. For example if an alert comes in, it has an entity such as email address of the user then it should send an approval email to that email that is in the entity.

So far I have in the Logic app designed: 

Microsoft Sentinel Alert (Preview) > Alert - Get incident > Send approval email but in the send approval email stage the "to" section I don't want a specific email but I want that email that is in the incident entity. 

Thank you!

[#2]

Hello @idontknowanything,

You can use "Parse JSON" where in the Content field put "Entities". 

This will allow you to parse entities based on the schema that you put in the Schema field. 

Check the first comment here: Parsing Entities from Azure Sentinel incident into Logic Apps for sending email - Microsoft Tech Com...

It has a detailed explanation.