Sentinel - Teams Playbook

Question

Hi,

I'm working on setting up a simple playbook to receive notifications for new incidents created in Sentinel, with an option to assign the incident. I've created an adaptive card (see below) and set up the playbook based on the instructions in a blog here. However, I'm struggling to find the dynamic content for the "Assign" field. I can see content showing who the incident is currently assigned to. Could someone assist me with this?

Notification which should look like this

Answer 1

@Someiah C S Thank you for reaching out to us, If you are looking for instructions how to use dynamic content and work with playbooks, please refer to this - https://learn.microsoft.com/en-us/azure/sentinel/playbook-triggers-actions

If the issue is to find "Assign to me" in the playbook so that it is assigned to the person, would recommend to check is users data returned in response, when you click "Assign to me" and use that field (either dynamic content, or if not available in dynamic content to use expressions). If that data is not available in response, would suggest using text field there to submit the value, and in text field enter UPN, and then pass that to Update Incident action to assign owner.

Let me know if you have any further questions, feel free to post back.

Answer 2

I think you are looking for Incident Owner.