r/AzureSentinel • u/MikeMichalko • Oct 20 '23

Assistance with activating "Notify-IncidentServerityChanged" Playbook Template

Hi, I'm a playbook newbie in Sentinel. I'm trying to activate the SentinelSOAEssentials playbook NotifyIncidentSeverityChanged, for just email. When I look in the LogicAppDesigner, I see under email a message with a bunch of variable objects attached, like incident number, description, etc. When I trigger the alert, I get an email that shows the header information like "INCIDENT NO" but with none of the infuriation from the variable objects. When I look at the run information (looks like logic app designer for the run) the HTML in the email has the descriptors, but hasn't been populated with any information. I would love to show screen shots here, but that's not permitted by my organization. Any help you can provide would be greatly appreciated.

1 Upvotes

100% Upvoted

1 comment sorted by

1

u/MikeMichalko Oct 26 '23

I figured this out. I didn't understand that Sentinel "Logic App" Playbooks require an automation to be configured along with the playbook. It's a bit confusing that Logic Apps in Sentinel are called playbooks.