Logic app(playbook) - condition set issue

Georgi Palazov 286 Reputation points
2022-10-19T14:22:46.223+00:00

Hello,

I deployed the following playbook from GitHub succesfully(https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Send-IngestionCostAnomalyAlert)
It provides the information I want and it sends an email, but I want to set a condition to ignore sending an email if the query returns no results.

Where's the issue in my set up?

Below you can find the email I receive when the query doesn't return any results and the condition set up for the logic app:

Email when query returns no results
252050-image.png

Set up:
252094-image.png

Azure Logic Apps
Azure Logic Apps
An Azure service that automates the access and use of data across clouds without writing code.
2,873 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
990 questions
0 comments
Accepted answer
  1. MayankBargali-MSFT 68,746 Reputation points
    2022-10-20T06:10:46.533+00:00

    @Georgi Palazov Thanks for reaching out. The output is base64 so you need to convert the base64 to string in your condition. You can either verify the string with contains "The query yielded no dataTable" or match the exact string as <body>The query yielded no dataTable.</body> as below 

    base64ToString(body('Run_query_and_visualize_results')?['body'])

    252284-image.png

    In the false condition you can specify your send email action. If the condition is True then that means it yields no result, so we don't need to send email.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Daniel Candela 21 Reputation points
    2022-10-19T18:16:18.51+00:00

    Hello There,
    It's possible to achieve this goal, just try to evaluate a "null" I mean if the variable not equal to null send mail Try to something like that - @equals(triggerBody()['jsonObj'] ? ['someProperty'], null)

    I hope you find the answer helpful
    Best Regards,
    Daniel