Alert-get incident showing resouce not found error in azure sentinel playbook - 404 error

Question

Hi All ,I have created a playbook in Azure&nbsp; Sentinel to trigger a ticket in Service Now&nbsp; for high severity incident in sentinel. Although I have deployed the playbook successfully but when I run trigger&nbsp;it always fail on the&nbsp;Alert - Get incident&nbsp;step with&nbsp;404 resource not found. Are there any special permissions needed ?What am i missing? Any info from someone that already deploy it ?Here is the output at Alert-get incident connector :{&nbsp;&nbsp;&nbsp;&nbsp;"statusCode":&nbsp;404,&nbsp;&nbsp;&nbsp;&nbsp;"headers":&nbsp;{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"Access-Control-Allow-Methods":&nbsp;"GET,&nbsp;PUT,&nbsp;PATCH,&nbsp;DELETE,&nbsp;POST",&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"Access-Control-Allow-Origin":&nbsp;"*",&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"Access-Control-Max-Age":&nbsp;"3600",&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"Access-Control-Expose-Headers":&nbsp;"*",&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"Date":&nbsp;"Tue,&nbsp;23&nbsp;Feb&nbsp;2021&nbsp;19:05:39&nbsp;GMT",&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"Content-Length":&nbsp;"54",&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"Content-Type":&nbsp;"application/json"&nbsp;&nbsp;&nbsp;&nbsp;},&nbsp;&nbsp;&nbsp;&nbsp;"body":&nbsp;{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"statusCode":&nbsp;404,&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"message":&nbsp;"Resource&nbsp;not&nbsp;found"&nbsp;&nbsp;&nbsp;&nbsp;}}I have contributor role in sentinel. Below is the snap of playbook created to trigger bidirectional sync to create and update incident in service now.&nbsp;&nbsp;Can someone help me to fix this issue ?&nbsp;&nbsp;

cyberhardik · Answer

Hi,is there any feedback on this ?

thijs lecomte · Answer

Can you share the input of the get incident step?Can you verify in the GUI that the alert is part of an incident? (through the incidents tab)

shannonhamby · Answer

Did you find a solution to this? I’m also noticing this error.

landau07 · Answer

Hi cyberHardik,This is caused by a small race condition at the time the incident is being ingested. 1. This should be fixed as we added retry mechanism to this action.2. Another thing you can do is to add a small delay action (1-3 seconds should be more than enough)3. You can use the new Incident Automation feature in Azure Sentinel to run playbooks based on Incident creation trigger and not alert creation - This is the recommended solutionYaron

cyberhardik · Answer

Well, I did checked the input and it was only the path through which it is trying to get incident.

below is the exact input :
{
"connection": {
"name": "/subscriptions/7f40b492-8297-4ke2-9b9f-4g416e3p6e3f/resourceGroups/PAC-PUC-KSG-PRD-SIEM/providers/Microsoft.Web/connections/azuresentinel-1"
}
}
Also i verified that alert was part of incident.

Forum Discussion

Alert-get incident showing resouce not found error in azure sentinel playbook - 404 error

Share

Resources