Incidents - Run Playbook

Triggers playbook on a specific incident

POST https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentIdentifier}/runPlaybook?api-version=2024-03-01

URI Parameters

Name In Required Type Description
incidentIdentifier
path True

string

Incident ID

resourceGroupName
path True

string

The name of the resource group. The name is case insensitive.

subscriptionId
path True

string

uuid

The ID of the target subscription. The value must be an UUID.

workspaceName
path True

string

The name of the workspace.

Regex pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$

api-version
query True

string

The API version to use for this operation.

Request Body

Name Type Description
requestBody

ManualTriggerRequestBody

Describes the request body for triggering a playbook on an incident.

Responses

Name Type Description
204 No Content

Success

Other Status Codes

CloudError

Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

Incidents_RunPlaybook

Sample request

POST https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ar4/runPlaybook?api-version=2024-03-01

Sample response

Definitions

Name Description
CloudError

Error response structure.

CloudErrorBody

Error details.

ManualTriggerRequestBody

Describes the request body for triggering a playbook on an incident.

CloudError

Error response structure.

Name Type Description
error

CloudErrorBody

Error data

CloudErrorBody

Error details.

Name Type Description
code

string

An identifier for the error. Codes are invariant and are intended to be consumed programmatically.

message

string

A message describing the error, intended to be suitable for display in a user interface.

ManualTriggerRequestBody

Describes the request body for triggering a playbook on an incident.

Name Type Description
logicAppsResourceId

string

The resource id of the playbook resource.

tenantId

string

The tenant id of the playbook resource.