Enrich-SentinelIncident-MDATPTVM

[noapocalypse]

Enrich-SentinelIncident-MDATPTVM

I believe the field names have changed for the Alert - Get Incident task.

Which means on running the playbook it attempts to query a path that looks something like the below

"/Cases///7a441234-b23c-4d88-e123-f123g123hi2j/"

And subsequently errors out with a 404

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[noapocalypse]

Looking through the playbook in more detail it's doing a number of things that have been replaced with easier methods.

Such as calling the old V2 Sentinel Incident Comment tasks, referring to none existent variables and using an old schema.

I'd recommend the whole playbook needs a rebuild. #7906 I've created a pull request with a version I believe resolves the issues.

@v-vdixit @v-rbajaj Feel free to check it out and see if it helps.

[v-rbajaj]

Hi @noapocalypse, Thanks for flagging this. Will take a look at the PR and let you know!

[v-vdixit]

Hi @noapocalypse we are reviewing the PR, thanks!

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[v-vdixit]

Hi @noapocalypse the PR is under review by the team, will update changes in PR, thanks!

[v-vdixit]

Hi @noapocalypse we are checking with the concerned team, will update you shortly, thanks!

[v-rbajaj]

Internal team is working on this and checking further.

[v-vdixit]

We are waiting to hear back from concerned team, thanks!

[v-vdixit]

We are still waiting to hear back from the concerned team, thanks!

[v-rbajaj]

Hi @noapocalypse, you will receive a final update on this issue by 25th July, 2023.

[v-rbajaj]

Since the closed PR has many bugs, that can't be pushed, new PR for this playbook will be raised soon.

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[v-rbajaj]

We are working and having a discussion internally on this

[v-rbajaj]

We are working on this and having a discussion internally on this

[ajkallur]

@manishkumar1991 @v-rbajaj the playbook can be released. Since, this is being published as an individual Sentinel Playbook and not being included part of the MDTI-Sentinel Content hub Solution.

[v-rbajaj]

We are having an internal discussion on this issue.

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[v-rbajaj]

Waiting for update from the respective team.

[v-rbajaj]

Hi all, we have raised a backlog item for this playbook and will discuss and update according to the discussions there.