Send Teams Adaptive Card on incident creation

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

This playbook will send Microsoft Teams Adaptive Card on incident creation, with the option to change the incident's severity and/or status.

Logic App Connectors

This playbook uses 3 Logic App connectors / built-in actions:

Connector / Action	Type	Connections	Actions
`azuresentinel`	Managed	1	0
`microsoftsentinel`	Managed	0	2
`teams`	Managed	1	0

Action parameters (URLs, paths, function IDs)

Action	Method	Endpoint	Other
Update_incident_-_update_severity	put	`/Incidents`	—
Update_incident_-_close_incident	put	`/Incidents`	—

📄 Source: Send-Teams-adaptive-card-on-incident-creation/readme.md

Author: Benjamin Kovacevic

This playbook will send Microsoft Teams Adaptive Card on incident creation, with the option to change the incident's severity and/or status.

Get Teams Group ID and Teams Channel ID. (instructions available on - https://www.linkedin.com/pulse/3-ways-locate-microsoft-team-id-christopher-barber-/). It is possible to choose Teams group and channel after deployment as well.

Deploy with incident trigger

After deployment, attach this playbook to an automation rule so it runs when the incident is created.

Navigate to Microsoft Sentinel → Settings → Settings
Scroll down to the Playbook permissions section
Click the Configure permissions button
In the Manage permissions side panel:
- Under the Browse tab, search and select the Resource Group that contains your Logic App Playbook
Click Apply
Return to your Automation Rule and try adding the playbook again – it should now be selectable (no longer grayed out)