Azure Sentinel Alert Queries to Slack

jcna 1 Reputation point
2021-02-04T07:51:50.103+00:00

Hello,

I am trying to configure sending alert queries to Slack and having some issues with displaying the information proper. I have a scheduled alert from Azure Sentinel, and displays data like so to Slack:

Excessive Windows logon failures (copy)User has over 50 Windows logon failures today and at least 33% of the count of logon failures over the previous 7 days.[{"$id":"3","HostName":"xx1010003","Type":"host"},

Is there a way to make a link to the query when posting the message to Slack and sanitize the message sent? My current Logic App flows are:

  1. When a response to an Azure Sentinel alert is triggered
  2. Run query and list results
  3. Post Message (Slack)

The other way i have it is eliminating Step 2 completely, and Slack always outputs the message but when I put the dynamic content expressions.. It doesn't seem to capture the alert name at all and just leaves it as [alert name][sourceip] "investigated"

Thoughts?

Azure Logic Apps
Azure Logic Apps
An Azure service that automates the access and use of data across clouds without writing code.
2,837 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
974 questions

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Pramod Valavala 20,516 Reputation points Microsoft Employee
    2021-02-16T04:25:12.337+00:00

    Based on the screenshot you've shared, instead of just using the tokens one after the other, you would have to follow formatting rules for slack messages.

    For example, to create a link with text as shown in their docs, you would need to use something like this - <*Incident URL Token*|Incident URL (or any text you need)>

  2. jcna 1 Reputation point
    2021-02-25T07:36:16.107+00:00

    I will review and keep you updated.

    0 comments
  3. jcna 1 Reputation point
    2021-03-04T13:14:59.123+00:00

    Still not getting the right output.. 

            "Post_message": {  
            "inputs": {  
                "host": {  
                    "connection": {  
                        "name": "@parameters('$connections')['slack']['connectionId']"  
                    }  
                },  
                "method": "post",  
                "path": "/chat.postMessage",  
                "queries": {  
                    "channel": "security-alert-testing",  
                    "text": "@{body('Alert_-_Get_incident')?['properties']?['title']}@{body('Alert_-_Get_incident')?['properties']?['createdTimeUtc']}@{body('Alert_-_Get_incident')?['properties']?['incidentUrl']}\n"  
                }

    Based on the slack link im not sure how to edit this proper as im doing dynamic calls for the alert and url to display. The doc provided has it for manual links. Can you point in the direction of how to parse it to display
    Alert Name/Type , Source, Destination, URL (shortened version)

    0 comments