Prompt User - Incident
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
↑ Back to Content Index
This playbook will ask the user if they completed the action from the Incident in Microsoft Sentinel. If so, it will close the incident and add a comment. If not, it will post a message to teams for the SOC to investigate and add a comment to the incident.
Logic App Connectors
This playbook uses 4 Logic App connectors / built-in actions:
Action parameters (URLs, paths, function IDs)
| Action |
Method |
Endpoint |
Other |
| Get_user |
get |
/v1.0/users/@{encodeURIComponent(concat(items('For_each')?['Name'], '@' ,items('For_each')?['UPNSuffix']))} |
— |
| Action |
Method |
Endpoint |
Other |
| Entities_-_Get_Accounts |
post |
/entities/account |
— |
| Add_comment_to_incident_(V3) |
post |
/Incidents/Comment |
— |
| Update_incident |
put |
/Incidents |
— |
| Add_comment_to_incident_(V3)_2 |
post |
/Incidents/Comment |
— |
| Action |
Method |
Endpoint |
Other |
| Post_message_in_a_chat_or_channel |
post |
/beta/teams/conversation/message/poster/@{encodeURIComponent('User')}/location/@{encodeURIComponent('Channel')} |
— |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
↑ Back to Playbooks · Back to Microsoft Entra ID