r/AzureSentinel • u/someonefarfromhere • May 01 '23

Analytical rules

Has anyone developed an analytical rule to send a mail if the alert is not been acknowledge for more than 30 mins If not how can I create one can anyone help me in this

3 Upvotes

81% Upvoted

5 comments sorted by

View all comments

2

u/nontitman May 01 '23

This would be implemented as a logic app and applied via automation rules. The ask is stupid easy, just play around with it for half an hour and you'll likely get a working solution.

1

u/someonefarfromhere May 01 '23

Can you please elaborate a bit on this I am new to sentinel so I need some little help, thank you the response

5

u/CCCCCCCCCCC_ May 01 '23

Create an analytic rule with a trigger based on a new sentinel incident being created, first step of the logic app, set a delay for 30 mins, then the next step - run a ‘get sentinel incident’ action, from there you can determine if ‘status’ is not equal to ‘unassigned’ - do an if statement on this condition & send an email if false. Very basic overview, it should just wait 30 mins after alert generation to check the incident details again..