Get-MDEInvestigationPackage-Entity-Trigger
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
↑ Back to Content Index
This playbook will call the collect invesitgation package in MDE based on Host entity. It will then loop until thats complete, once complete it will add a comment to the incident (in case we invoke this playbook from the incident context) and post a message in teams with the URL to download the package.
| Attribute |
Value |
| Type |
Playbook |
| Solution |
Standalone Content |
| Source |
View on GitHub |
Logic App Connectors
This playbook uses 3 Logic App connectors / built-in actions:
Action parameters (URLs, paths, function IDs)
| Action |
Method |
Endpoint |
Other |
| Add_comment_to_incident_(V3) |
post |
/Incidents/Comment |
— |
| Action |
Method |
Endpoint |
Other |
| Post_a_message_(V3) |
post |
/v3/beta/teams/@{encodeURIComponent(parameters('TeamsId'))}/channels/@{encodeURIComponent(parameters('TeamsChannelId'))}/messages |
— |
| Action |
Method |
Endpoint |
Other |
| Actions_-_Collect_investigation_package |
post |
/api/machines/@{encodeURIComponent(body('Machines_-_Get_single_machine')?['id'])}/collectInvestigationPackage |
— |
| Actions_-_Get_investigation_package_download_URI |
get |
/api/machineactions/@{encodeURIComponent(body('Actions_-_Collect_investigation_package')?['id'])}/getPackageUri |
— |
| Machines_-_Get_single_machine |
get |
/api/machines/@{encodeURIComponent(triggerBody()?['Entity']?['properties']?['HostName'])} |
— |
| Actions_-_Get_single_machine_action |
get |
/api/machineactions/@{encodeURIComponent(body('Actions_-_Collect_investigation_package')?['id'])} |
— |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
↑ Back to Playbooks