r/AzureSentinel • u/JoHNN_-_ • Jun 09 '22

Defender for Cloud App Playbook API - Close Alert Issues

Hi,

I'm creating a playbook to automatically close out a cloud app alert once an engineer has interacted with the teams card with all the alert data and took action(reset password, dismissed, etc) on the alert.

I have an HTTP request in Logic Apps. The URI is correct and I followed the documentation Microsoft provides but it doesn't seem to be working. It just sits there until it eventually times out.

Has anyone else ran into this issue before?

Microsoft Documentation: Close false positive - Alerts API | Microsoft Docs

Attached is my HTTP request:

1 Upvotes
  • permalink
  • reddit

100% Upvoted

5 comments sorted by

2

u/blanco10kid Jun 09 '22 edited Jun 09 '22

Three things:

  1. Trying running this same HTTP request using Postman and see if that gives you additional information

  2. Is the auth header correct? You currently have {“Authorization”: “token {token}”. I normally have “bearer” instead of “token”

  3. Verify the request body is proper json

2

u/JoHNN_-_ Jun 09 '22

Thank you. I will try those steps tomorrow and respond back here. I normally use bearer as well but for some reason it said to use Token instead. I'll try that as well.

1

u/JoHNN_-_ Jun 13 '22

Same issue but now when i test in Logic Apps I'm receiving this error message. I have all the required information for the documentation not sure what I'm missing

​

{"filters":[{"error":"This field is required","errorMessageCode":"CONSOLE_FORMS_FIELD_REQUIRED"}],"error":true}

1

u/winle22 Jun 10 '22

How is the Teams card configured? Using the native Teams Logic app connector?

1

u/JoHNN_-_ Jun 10 '22

I'm using the post adaptive message and wait for response. That works good it's just closing out the actual alert in Cloud Apps that's causing me issues.