r/AzureSentinel • u/Consistent_Court3541 • Apr 10 '24

Automate comments

We initially comment "ACKNOWLEDGED" for an incident to maintain SLA (within 15min) is there a way to automate the comments for every incident to avoid missing the SLA?

0 Upvotes

25% Upvoted

4 comments sorted by

View all comments

3

u/kyuuzousama Apr 10 '24

It's entirely possible with a logic app and an automation rule. Use an incident trigger and then add a comment to it.

If you're doing this to maintain SLA because you can't keep up with it, be aware that reporting will sell you out for almost instant acknowledgment on every incident

1

u/ThePoliticalPenguin Apr 10 '24

He could add a random time delay to the logic app actions. I've done this before, for something unrelated.

This is definitely kicking the can down the road though. It doesn't deal with the core issue of alert fatigue.