logic App to ingest notification of azure monitor alerte to Microsoft sentinel

Dhahri, Arwa 0 Reputation points
2024-11-08T17:44:51.8966667+00:00

Hi,

In the alert rule configuration for Azure Monitoring, I need to set up an action group (Logic App) that will forward all alert notifications to Microsoft Sentinel. However, I require assistance with designing a Logic App that meets my needs, as I'm currently unable to create the correct design of the Logic App.

Azure Logic Apps
Azure Logic Apps
An Azure service that automates the access and use of data across clouds without writing code.
3,240 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,174 questions
{count} votes

1 answer

Sort by: Most helpful
  1. LeelaRajeshSayana-MSFT 16,611 Reputation points
    2024-11-09T00:51:45.43+00:00

    Hi @Dhahri, Arwa Greetings! Welcome to Microsoft Q&A forum. Thank you for posting this question here.

    There are couple of bindings you would need to make to finish the flow for your use case

    1. Integrate Azure Monitor with Logic App
    2. Use Microsoft Sentinel connector in Logic app and push the incidents or modify them as needed

    To get your alert events forwarded to the Logic App you can reference the article Integrate with Logic App which provides you detailed steps on how to Create a Logic App that accepts a body in the form of JSON schema that has the format an Azure monitor alert. The article also provides the steps on how to Create an Action group and bind the Azure Monitor alerts to the above created Logic App.

    Within the Logic App, you can create a connection with the Microsoft Sentinel using the connector Microsoft Sentinel (Preview) and use any of the supported actions to push the data to the Sentinel end point.

    Hope this helps! If you need any additional assistance, please let us know more details on the specific alert or rule you are trying to monitor.


    If the response helped, please do click Accept Answer and Yes for the answer provided. Doing so would help other community members with similar issue identify the solution. I highly appreciate your contribution to the community.


Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.