How to - add Watchlist as an Incident comment

Georgi Palazov 286 Reputation points
2022-11-17T13:42:32.96+00:00

Hello,

I'm trying insert а watchlist as a comment when an incident triggers. Unfortunately this fails. If i remove the step "add comment to incident" i successfully receive an email containing the watchlist in a HTML table. I supposed this might be an incorrect way of inserting the watchlist into the comment section of an Incident.

261380-image.png

261447-image.png

OUTPUT from where it fails:

{
"error": {
"code": 400,
"source": "logic-apis-westeurope.azure-apim.net",
"clientRequestId": "52f807cd-5a22-47ed-b36c-25eeb25e0b8a",
"message": "The response is not in a JSON format.",
"innerError": "Comment length should not exceed 30000 characters"
}
}

Azure Logic Apps
Azure Logic Apps
An Azure service that automates the access and use of data across clouds without writing code.
3,563 questions
Microsoft Security | Microsoft Sentinel
{count} votes

Accepted answer
  1. Andrew Blumhardt 10,051 Reputation points Microsoft Employee
    2022-11-17T16:32:10.017+00:00

    This error "The response is not in a JSON format." usually means that the prior activity was misconfigured or the expected input was not properly formatted. The query activity output may not be compatible with the comment action without modification.

    Options:
    -Change the query to output less data or change the output
    -Parse the body (output) using a JSON parser activity
    -Look for examples for how other playbooks reuse query output (maybe formatting as an HTML table for example).

    0 comments No comments

0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.