Sentinel Playbook Issue

[leoszalkowski]

I have a set of playbooks to run automatically when an incident is created from an alert. So far it's been working well without issues, until today.

The playbook hasn't been running for the alerts every time. It will run for a handful, but won't run for most. Inside the logic app page for the playbook, there is no errors that appear on attempted runs for the alert.

[#2 · Accepted solution]

@leoszalkowski I discovered today that our subscription was impacted by a Log Analytics disruption yesterday between 00:28 and 04:04 UTC. That is around the time the playbooks have stopped working, and are still being impacted.

[#3]

It was not resolved @Rod_Trent.

The issue was narrowed down to the playbook running in one of the tenants my company is managing. The playbook is getting a 404: not found error when it's run.

Not sure if some permissions were changed in the tenant or if it could be a separate issue.

[#4]

@leoszalkowski 

So, just one tenant has the issue? Where was the original Playbook created? Does this tenant reside in a different datacenter/region? 

Does the Playbook work if run manually?

[#5]

So it's a strange issue.

The playbook is located in our tenant. Our region is different than our customers' region.

It was running perfectly fine for the past two weeks, up until yesterday morning for the one customer's tenant.

The playbook runs manually if I run it from inside of the incident details page.

It does not run, however, if I go to the specific playbook overview and run the trigger.

[#6]

@leoszalkowski 

What error notification do you receive when the Trigger fails to run? Anything?

[#7]

I get the 404 Not Found on the Get Incident block of my logic app.

When I try to diagnose the issue using the Logic App Diagnose and Solve Problems tool, I get this error:

"The detector couldn't identify the subscription, resource group or workflow specified in the URL. Please check your link."

[#8]

Quick update.. (still no solution)

I did some more digging into this issue. Within the playbook error, it's looking like the playbook block that's throwing the error is not getting the correct output. 

I went back through the run history and noticed the raw outputs are drastically different. It is receiving different header information and no body information.

[#9]

@leoszalkowski FYI: https://techcommunity.microsoft.com/t5/azure-sentinel/sentinel-alerts-stopped-running-playbooks/m-p/... 

[#10]

@Rod_Trent Perfect, I also have a support ticket open with Microsoft. I got a response asking for some more information but still waiting to here back.

As of today, all of our playbooks are not working now. 

Guess it's an outage?

[#11]

@leoszalkowski Checking on it now that I'm back in the office.

[#12]

@leoszalkowski Message me your ticket number.