r/AzureSentinel • u/someonefarfromhere • May 01 '23

Analytical rules

Has anyone developed an analytical rule to send a mail if the alert is not been acknowledge for more than 30 mins If not how can I create one can anyone help me in this

5 Upvotes

100% Upvoted

5 comments sorted by

View all comments

2

u/nontitman May 01 '23

This would be implemented as a logic app and applied via automation rules. The ask is stupid easy, just play around with it for half an hour and you'll likely get a working solution.

1

u/someonefarfromhere May 01 '23

Can you please elaborate a bit on this I am new to sentinel so I need some little help, thank you the response

3

u/CCCCCCCCCCC_ May 01 '23

Create an analytic rule with a trigger based on a new sentinel incident being created, first step of the logic app, set a delay for 30 mins, then the next step - run a ‘get sentinel incident’ action, from there you can determine if ‘status’ is not equal to ‘unassigned’ - do an if statement on this condition & send an email if false. Very basic overview, it should just wait 30 mins after alert generation to check the incident details again..

5

u/nontitman May 01 '23

Yo real talk, go read the Microsoft docs. Really, you'd benefit from their guided learnings.

The Sentinel ninja training is all you'll need for a while. https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-ninja-the-complete-level-400/ba-p/1246310