Automation rules not working

[DevMickeal]

Describe the bug
I am trying to create automation rules to auto-close incidents coming from Microsoft Defender for the endpoint.

To Reproduce
I used the create incident task from the incident details, it is very weird this is not working

Expected behavior
The automation rule ought to close the rule

Screenshots

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[v-rbajaj]

Hi @DevMickeal, Thanks for flagging this, we are looking into this and will get back to you.

[Bolubalog]

@v-rbajaj, thank you for picking this up. We'll appreciate if we can get immediate response on this.

[v-rbajaj]

Hi @DevMickeal,
I had received similar issue in which BenjiSec recommended to use Microsoft 365 Defender in Issue #8151. Are you facing the similar issue? I hope this helps

Utilize Microsoft 365 Defender connector instead of Microsoft Defender for Endpoint standalone connector?
Microsoft 365 Connector have bi-directional sync of incidents/alerts, so when incident is closed in Microsoft Sentinel it is closed in Microsoft 365 Defender, and vice versa, when it is closed in Microsoft 365 Defender it is closed in Microsoft Sentinel.
https://learn.microsoft.com/en-us/azure/sentinel/connect-microsoft-365-defender
NOTE: If enabling this connector, make sure that all Microsoft Incident Creation Rules for MDE, MDO, MDI, MDA and AAD Identity Protection (If AAD IP alerts are being synced to M365D), are turned off. This should be done automatically by enabling M365D connector. If they are not disabled, you will get double incidents - one from M365D connector (that we want) and second from Microsoft Incident Creation Rule that is not disabled.

If you don't want to utilize M365D connector, but strictly MDE connector with Microsoft Incident Creation Rule, you will need to create automation that will run on recurring event (like 5 minutes), check closed incidents/alerts in MDE in those 5 minutes (, find them in Sentinel using Azure Monitor Logs action, and update each incident in Sentinel as closed.
MDE API that you will need to utilize
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/get-alerts?view=o365-worldwide
you will need to filter on events "status" and "resolvedTime" as you need only closed alerts that are closed in last 5 minutes for example. Then you will need to find that alert in sentinel using KQL and Azure Monitor Logs action called Run query and list results. Last step is to update Sentinel incident.
We recommend use of M365D connector as this is built in the connector itself.

[v-rbajaj]

Hi @DevMickeal, waiting for your confirmation, please provide some update on the above comment.

[Bolubalog]

Hi @v-rbajaj, please give time till tomorrow, will review and get back to you

[Bolubalog]

Hello @v-rbajaj, currently we have Microsoft 365 Defender connector enabled in sentinel, and the expected is that we go to sentinel dashboard for the monitoring and close out incidents. Does this mean that the automation/playbook feature on Microsoft Sentinel isn't working?

[v-rbajaj]

@Bolubalog, no this does not implies that the automation/playbook feature isn't working.

You can leverage Microsoft 365 Defender capabilities and that will help you to resolve your issue.

[Bolubalog]

@v-rbajaj thank you for your response, if it doesn't imply that the rule isn't working, why exactly are we not able to run the playbook against our incidents.
Since we have this feature setup already on sentinel, I don't see a need to go to M365D to do this.

[v-rbajaj]

Hi @Bolubalog, ok, will get back to you on why this playbook isn't working for auto close of incidents by 22 Sep 2023 .

[Bolubalog]

Thank you @v-rbajaj

[v-rbajaj]

Hi @Bolubalog, we have reached out to concerned team on this issue and will get back to you by 27 Sep 2023.

[Bolubalog]

Thank you @v-rbajaj

[v-rbajaj]

Hi @DevMickeal, Seems like the there is a problem with settings of the automation rule.
Below settings should work.

[Bolubalog]

Hi @v-rbajaj you mean we should try the settings in the format in the screenshot you provided and test?

[v-rbajaj]

Hi @Bolubalog, yes please..

[Bolubalog]

Okay, I will test and revert by tomorrow.
Thank you

[v-rbajaj]

Hi @Bolubalog, can you please provide some update on this issue?

[Bolubalog]

@v-rbajaj Please give me until thursday, I have been on leave.

Will test and revert.

[v-rbajaj]

Hi @Bolubalog, sure, noted, thanks!

[v-rbajaj]

Hi @Bolubalog, did you get a chance to look into this issue?

[v-rbajaj]

Hi @Bolubalog, Since we have not received a response in the last 5 days, we are closing your issue #8936 as per our standard operating procedures. If you still need support for this issue, feel free to re-open at any time. Thank you for your co-operation.