Dynamic content from Sentinel connector in Logic App is missing, basically empty.

Question

Hello.

I'm using Sentinel Incident Connector in my Logic App to send SMS when high severity alert is created. But the dynamic content seems to be missing recently -- it worked few weeks ago. All dynamic content I get is empty.

To demonstrate the situation, I added some actions when condition is false, and I created sample alerts with both high and medium severities in Defender for Cloud, which ended up in Sentinel too.

The result is that I did get some SMSs, but all with content:

False condition [Azure Alert]:  [Severity]:   [Start time in UTC]:

So clearly the dynamic content is all missing. I noticed that the Sentinel Incident connector is in preview, but is there anything causing the issue on Azure side? Thanks.

Cheers,

Roy

Answer 1

The connector was updated recently I think to add some new threat intelligence actions. You might try recreating to make sure you have the latest version. You can also open a support case in the portal.