Sentinel - Teams Playbook

Someiah C S 80 Reputation points
2024-04-09T07:29:27.5933333+00:00

Hi,

I'm working on setting up a simple playbook to receive notifications for new incidents created in Sentinel, with an option to assign the incident. I've created an adaptive card (see below) and set up the playbook based on the instructions in a blog here. However, I'm struggling to find the dynamic content for the "Assign" field. I can see content showing who the incident is currently assigned to. Could someone assist me with this?

Notification which should look like this

User's image

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,135 questions
Azure Startups
Azure Startups
Azure: A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.Startups: Companies that are in their initial stages of business and typically developing a business model and seeking financing.
258 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Givary-MSFT 32,581 Reputation points Microsoft Employee
    2024-04-12T10:57:21.76+00:00

    @Someiah C S Thank you for reaching out to us, If you are looking for instructions how to use dynamic content and work with playbooks, please refer to this - https://video2.skills-academy.com/en-us/azure/sentinel/playbook-triggers-actions

    If the issue is to find "Assign to me" in the playbook so that it is assigned to the person, would recommend to check is users data returned in response, when you click "Assign to me" and use that field (either dynamic content, or if not available in dynamic content to use expressions). If that data is not available in response, would suggest using text field there to submit the value, and in text field enter UPN, and then pass that to Update Incident action to assign owner.

    Let me know if you have any further questions, feel free to post back.

    0 comments
  2. Andrew Blumhardt 9,861 Reputation points Microsoft Employee
    2024-04-12T15:48:50.3466667+00:00

    I think you are looking for Incident Owner. User's image

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.