Adding Incident URL to Email

[mperrotta]

I have seen a few people ask how to get the Incident URL to show up in an email when calling a playbook. I was able to get this working by manually constructing the URL. I would consider this more of a workaround, the URL format could change at any time on Microsoft's end.

Essentially, what we are doing is adding the Incident ID onto the base URL:  https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident/

1. Within the Logic App, you will need to get the Incident Details
2. The Incident Details will need to be parsed by the JSON parser, the schema is at the bottom of this post
3. Then Initialize a variable using the Base URL Value: https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident/ and adding the Id parameter from the Parse JSON action
4. Then you can insert that variable into your email body

Within your logicapp it will look similar to this:

JSON Schema:

{
    "properties": {
        "etag": {
            "type": "string"
        },
        "id": {
            "type": "string"
        },
        "kind": {},
        "name": {
            "type": "string"
        },
        "properties": {
            "properties": {
                "AssignedTo": {},
                "CaseNumber": {
                    "type": "integer"
                },
                "CloseReason": {},
                "ClosedReasonText": {},
                "CreatedTimeUtc": {
                    "type": "string"
                },
                "Description": {
                    "type": "string"
                },
                "EndTimeUtc": {
                    "type": "string"
                },
                "FirstAlertTimeGenerated": {
                    "type": "string"
                },
                "Labels": {
                    "type": "array"
                },
                "LastAlertTimeGenerated": {
                    "type": "string"
                },
                "LastUpdatedTimeUtc": {
                    "type": "string"
                },
                "Metrics": {
                    "properties": {
                        "SecurityAlert": {
                            "type": "integer"
                        }
                    },
                    "type": "object"
                },
                "RelatedAlertIds": {
                    "items": {
                        "type": "string"
                    },
                    "type": "array"
                },
                "Severity": {
                    "type": "string"
                },
                "StartTimeUtc": {
                    "type": "string"
                },
                "Status": {
                    "type": "string"
                },
                "Title": {
                    "type": "string"
                }
            },
            "type": "object"
        },
        "tags": {},
        "type": {
            "type": "string"
        }
    },
    "type": "object"
}

[#2]

@mperrotta This is great.  Nice job!

I also have a KQL query that parses it out of AzureActivity:

https://github.com/rod-trent/SentinelKQL/blob/master/SentinelIncidentURLs-%20ALL.txt

[#3]

@mperrotta : Great workaround!

Note that the incident URL is available through the API (see here) and should not be very hard to call from Logic Apps. We have also started private preview for triggering Playbooks on incident creation, which will provide easier access to incident details, including the URL.