Incident Assignment Shifts
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
This playbook will assign an Incident to an owner based on the Shifts schedule in Microsoft Teams. When an incident is assigned, the incident owner will be notified via email. Incidents are assigned to users based on the following criteria:
Only users who have started their shifts during the time the Logic App runs will be considered. Users who still have at least 1 hours left before going off shift (can be configured in playbook) *User with the least incidents assigned on the current Shif
| Attribute | Value |
|---|---|
| Type | Playbook |
| Solution | SentinelSOARessentials |
| Source | View on GitHub |
Additional Documentation
📄 Source: Incident-Assignment-Shifts/readme.md
Incident-Assignment-Shifts
author: Jeremy Tan
version: 2.2
This playbook will assign an Incident to an owner based on the Shifts schedule in Microsoft Teams.
Pre-requisites:
Ensure you have the following details:
1. User account or Service Principal or Managed Identity with Microsoft Sentinel Responder role
-
Create or use an existing user account/ Service Principal/ Managed Identity with Microsoft Sentinel Responder role.
-
This will be used in Microsoft Sentinel connectors (Incident Trigger, Update incident & Add comment to incident) and a HTTP connector.
-
This example will walk you through using System Managed Identity for the above connectors.
2. Setup Shifts schedule
-
You must have the Shifts schedule setup in Microsoft Teams.
-
The Shifts schedule must be published (Share with team).
3. User account with Owner role in Microsoft Teams
-
Create or use an existing user account or managed identity with Owner role in a Team.
-
The user account will be used in Shifts connector (List all shifts).
4. User account or Service Principal with Log Analytics Reader role
-
Create or use an existing user account or Service Principal with Log Analytics Reader role on the Microsoft Sentinel workspace.
-
The user account or Service Principal will be used in Azure Monitor Logs connector (Run query and list results).
5. An O365 account to be used to send email notification
- The user account will be used in O365 connector (Send an email).
Post Deployment Configuration:
1. Enable Managed Identity and configure role assignment
- Once deployed, go to the Logic App's blade and click on Identity under Settings.
- Select On under the System assigned tab. Click Save and select Yes when prompted.
- Click on Azure role assignments to assign role to the Managed Identity.
- Click on + Add role assignment.
- Select Resource group under Scope and select the Subscription and Resource group where the Microsoft Sentinel Workspace is located. Select Microsoft Sentinel Responder under Role and click Save.
2. Configure connections
- Edit the Logic App or go to Logic app designer.
- Expand each step to find the following connectors (6 in total) with
.
1. Incident Trigger
2. Update Incident
3. Add comment to incident
4. List all shifts
5. Run query and list results
6. Send an email - Fix these connectors by adding a new connection to each connector and sign in with the accounts described under pre-requisites.
3. Select the Shifts schedule
- Edit the Logic App or go to Logic app designer.
- Find the List all shifts connector, click on the X sign next to Team field for the drop-down list to appear.
- Select the Teams channel with your Shifts schedule from the drop-down list.
- Save the Logic App once you have completed the above steps.
Incident Assignment Logic:
Incidents are assigned to users based on the following criteria:
- Only users who have started their shifts during the time the Logic App runs will be considered.
[Content truncated...]
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊