Help with "Do not send email if 'The query yielded no dataTable'

Question

We've been building out our Sentinel environment for a few weeks now and have multiple reports that are being emailed to my team on a regular basis. Only problem is that some of these reports come back with a blank email stating "The query yielded no dataTable".

I'm trying to set up a condition in the logic app to only send an email if there is actual content so we don't have as much noise, but I can't find the right combination for it to work.

I think the condition command with a true and false value is the way to do it, but how can I get my logicapp to pick up on a null value from the query properly?

Answer 1

@Early, Brandon Thanks for reaching out. I will suggest you to navigate to the run history and find the run which has yet no result. Go to your action and check what the response is from the action and based on that you can leverage the condition statement to decide whether you want to send the email or not. In case if you are not able to figure it out then please share the sample response from the action for which the result was null/empty.