question

JeffA-9480 avatar image
0 Votes"
JeffA-9480 asked JeffA-9480 commented

Sentinel Automation triggers with playbooks are buggy

Hi,

I struggled for days about this i18n issue. Can someone confirm that this is a bug or if I made something wrong whatsoever? How to declare a bug?

I created in the same RG two Logic Apps.

1st logic apps is seen by Sentinel as "Sentinel action" in playbooks but can't be mapped in Automation rule action.

 "triggers": {
     "Quand_la_règle_de_création_de_l’incident_Azure_Sentinel_a_été_créée": {
         "inputs": {
             "body": {
                 "callback_url": "@{listCallbackUrl()}"
             },
             "host": {
                 "connection": {
                     "name": "@parameters('$connections')['azuresentinel']['connectionId']"
                 }
             },
             "path": "/incident-creation"
         },
         "type": "ApiConnectionWebhook"
     }
 }


Second one is perfectly seen in Automation:

    "triggers": {
         "When_Azure_Sentinel_incident_creation_rule_was_triggered": {
             "inputs": {
                 "body": {
                     "callback_url": "@{listCallbackUrl()}"
                 },
                 "host": {
                     "connection": {
                         "name": "@parameters('$connections')['azuresentinel']['connectionId']"
                     }
                 },
                 "path": "/incident-creation"
             },
             "type": "ApiConnectionWebhook"
         }
     }



It looks to me that Sentinel detection of trigger heavily depends on the name instead of static value. But I18n depends on what are languages in block creation.

Can anyone confirm?






azure-logic-appsmicrosoft-sentinel
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@JeffA-9480 I tried using the same trigger name and could see it being recognized as expected. Could you re-check?

0 Votes 0 ·

0 Answers