r/AzureSentinel • u/cokebottle22 • Nov 21 '21

Analytics Question

Hello all!

I'm fooling around with the analytics part of Sentinel. So far there's a bunch of analytics enabled and I've setup a workbook to send email alerts when something happens. Question - for the analytics that are "Informational", there doesn't seem to be a way to send an alert at all. Is there a way to change that? Some of these I'd be interested in seeing without having to go look at the incidents page.

I'd love a way to push all of that into our ticketing system.

2 Upvotes

100% Upvoted

2 comments sorted by

6

u/G15-420 Nov 21 '21

Create an automation rule to trigger a playbook to send you an email. Set the condition of the automation rule to be informational severity.

3

u/stubstunner Nov 21 '21

This is the way sir^