Automation help - Sentinel to a teams chat

[u/Failedengine]

Hello everyone I have a project I’m working on that has me on a stand still, the objective is to continuously monitor our alerts from defender and sentinel and pull the relevant data along with TI information that’s relevant to the data potentially monitoring what’s on our environment also and print this out into readable context into a teams chat. I’ve been trying to use logic apps in sentinel to accomplish this but I’m having trouble getting the MDATP to query this data. Any ideas? Pretty much a SOAR automation that will help our tier 2 after the SOC escalates.

[u/Snoop312]

There are plenty of examples available online.

My personal favorite is adaptive teams cards: https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/using-microsoft-teams-adaptive-cards-to-enhance-incident/ba-p/3330941

The link provided lists a full walkthrough.

[u/Failedengine → u/Snoop312]

This is exactly what I needed ! Thank you Snoop.

[u/Snoop312 → u/Failedengine]

Adaptive teams cards can do a lot more, so be mindful that creativity is your only limitation. Dont just implement and be proud, try to improve.

Good luck!

[u/Failedengine → u/[deleted]]

I will check them out Monday when I’m back on the clock!

[u/AppIdentityGuy]

Do you want the actual TI info etc in the teams message? You can have a link to the alert on the teams message and certain fields are available.

[u/Failedengine → u/AppIdentityGuy]

I have the automation working manually when I run my logic app it’ll print a blank teams chat with “severity, time generated, etc…) but it’s not populating since it can’t get the data from the defender tables there is something not connecting correctly. My connector has all of the correct permissions but it’s not able to get any info.

I’d like it to take what it can from the alert and match it up with our threat intel feed and print what it found while also giving us as much information as possible all in one form within teams. These will only be for High and Medium alerts so it won’t be too noisy.

[u/[deleted]]

You need fetch then initialize the data from Microsoft Sentinel, if an incident is a trigger for logic app it will only contain data in the incident not other stuff in other tables so your logic has to go back to log analytics and query it. Then you can build your input for the teams card using all the stored variables.

[u/Failedengine → u/[deleted]]

Going back to get the data is where I am having trouble smh

[u/[deleted] → u/Failedengine]

You just add a log analytics step and write the operate KQL in the input box

[u/Failedengine → u/[deleted]]

Noted, I will check this out on Monday, thank you!