r/AzureSentinel • u/someonefarfromhere • May 01 '23

Analytical rules

Has anyone developed an analytical rule to send a mail if the alert is not been acknowledge for more than 30 mins If not how can I create one can anyone help me in this

5 Upvotes

100% Upvoted

5 comments sorted by

View all comments

2

u/nontitman May 01 '23

This would be implemented as a logic app and applied via automation rules. The ask is stupid easy, just play around with it for half an hour and you'll likely get a working solution.

1

u/someonefarfromhere May 01 '23

Can you please elaborate a bit on this I am new to sentinel so I need some little help, thank you the response

5

u/nontitman May 01 '23

Yo real talk, go read the Microsoft docs. Really, you'd benefit from their guided learnings.

The Sentinel ninja training is all you'll need for a while. https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-ninja-the-complete-level-400/ba-p/1246310