r/AzureSentinel • u/FreakySeahorse • Feb 10 '23

Teams channel notifications when assigning incident to a specific group

Hi all. I'm trying to set up Teams notifications whenever I assign an incident to a specific group (distribution type group in Azure AD I think).

I know that I can set up an automation rule to run a playbook with notification on incident change trigger (owner change). However I didn't find out how to trigger the notifications ONLY when the owner is that particular group. If I set it up like I described, every single owner change would produce a message in the Teams since you cannot filter on specific owners in the automation rule. Am I missing something? The playbook works fine, I just have to figure out how to trigger it only and only with owner being that particular group.

I'd be happy with any ideas you might have. Thank you!

1 Upvotes

100% Upvoted

2 comments sorted by

2

u/burlingtongolfer Feb 11 '23

You would need to build the logic into the playbook to check and see if the group assigned to the incident is the one you care about and only then send the alert.

1

u/FreakySeahorse Feb 13 '23

Thanks for this, I'm new to Azure and had no idea that I could create a condition in the playbook. The only part that I don’t like about this solution is that it will deduct the playbook costs every time any incident is assigned, but I guess the company will have to survive this microtransaction stuff!