Get-MDEInvestigationPackage

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


Attribute Value
Type Playbook
Solution Standalone Content
Source View on GitHub

Logic App Connectors

This playbook uses 3 Logic App connectors / built-in actions:

Connector / Action Type Connections Actions
azuresentinel Managed 1 3
teams Managed 1 1
wdatp Managed 1 4
Action parameters (URLs, paths, function IDs)

azuresentinel (Managed)

Action Method Endpoint Other
Alert_-_Get_incident get /Incidents/subscriptions/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/resourceGroups/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}/workspaces/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/alerts/@{encodeURIComponent(triggerBody()?['SystemAlertId'])}
Entities_-_Get_Hosts post /entities/host
Add_comment_to_incident_(V3) post /Incidents/Comment

teams (Managed)

Action Method Endpoint Other
Post_a_message_(V3) post /v3/beta/teams/@{encodeURIComponent(parameters('TeamsId'))}/channels/@{encodeURIComponent(parameters('TeamsChannelId'))}/messages

wdatp (Managed)

Action Method Endpoint Other
Actions_-_Collect_investigation_package post /api/machines/@{encodeURIComponent(body('Machines_-_Get_single_machine')?['id'])}/collectInvestigationPackage
Actions_-_Get_investigation_package_download_URI get /api/machineactions/@{encodeURIComponent(body('Actions_-_Collect_investigation_package')?['id'])}/getPackageUri
Machines_-_Get_single_machine get /api/machines/@{encodeURIComponent(items('For_each')?['HostName'])}
Actions_-_Get_single_machine_action get /api/machineactions/@{encodeURIComponent(body('Actions_-_Collect_investigation_package')?['id'])}

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Playbooks