SOLVED

details of connectors triggering alerts

%3CLINGO-SUB%20id%3D%22lingo-sub-3064427%22%20slang%3D%22en-US%22%3Edetails%20of%20connectors%20triggering%20alerts%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3064427%22%20slang%3D%22en-US%22%3E%3CP%3EHey%20all!%20Hope%20you%20are%20doing%20well.%20I%20have%20a%20playbook%20that%20triggers%20creates%20incident%20ticket%20to%20a%20third%20party%20incident%20management%20software.%3C%2FP%3E%3CP%3EI%20have%20been%20trying%20to%20figure%20out%20how%20to%20include%20the%20details%20of%20the%20connector%20from%20where%20the%20alert%20is%20triggered.%3C%2FP%3E%3CP%3EThis%20is%20not%20presently%20featured%20on%20the%20logic%20apps%20and%20if%20I%20were%20to%20raise%20a%20feature%20request%2C%20how%20do%20I%20go%20about%20it%3F%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

Hey all! Hope you are doing well. I have a playbook that triggers creates incident ticket to a third party incident management software.

I have been trying to figure out how to include the details of the connector from where the alert is triggered.

This is not presently featured on the logic apps and if I were to raise a feature request, how do I go about it?

Thanks

2 Replies
best response confirmed by gbenga_crown (New Contributor)
Solution

@gbenga_crown 1) The place to ask for enhancements is Microsoft Sentinel · Community (azure.com)

2) It may be a difficult request since multiple connectors can feed to a single table (think of all the data connectors that populate Syslog and CEF.  I stopped counting the OOTB connectors that publish to CEF (16 when I stopped) and Syslog (5 when I stopped) so you can see what kind of an issue this could be.

 

With those aside, what you could do in the meantime is use a Watchlist to do a mapping of the Analytics rule to the Connector or the table to the connector and query that as part of your Logic App.

Thanks very much @GaryA
We support Ukraine and condemn war. Push Russian government to act against war. Be brave, vocal and show your support to Ukraine. Follow the latest news HERE