not able to send an email to the affected user linked to an incident generated by sentinel

Question

I trued to apply a couple tutorials and suggestion but my playbook always fails.

I mapped as entities : Account, Mailbox (with UPN as identifier).

Sentinel successfully generates the incident using the KQL code so I use Get incident (get account in previous tests), search for users V2 and Send an email (V2) but I am always getting bad request because when Sentinel, generates the UPN or account Name, it normalizes it and gets an inaccurate UPN or no UPN at all :

  },
    "body": {
        "To": null,
        "Subject": "test",
        "Body": "<p class=\"editor-paragraph\">test</p>",
        "Importance": "Normal"
    }

I even tried to extend my KQL code win order to genearte the UPN directly from there, but I am still not able to get the UPN sent to the action get incident in the playbook :

 extend UPN = strcat(InitiatingProcessAccountName, "@mydomain.com")
| extend CustomDetails = bag_pack("UPN", UPN)

C

Could you please provide assistance

Thanks in advance

Answer 1

Hello @Louis Siepen,

Based on the description you're experiencing an issue where the "Send an email (V2)" action in your Logic App fails because the "To" field receives a null value, resulting in a Bad Request error. This is happening even though you've correctly constructed the UPN in your KQL query using extend UPN = strcat(InitiatingProcessAccountName, "@mydomain.com") and added it to the CustomDetails using bag_pack("UPN", UPN). The root cause is that while CustomDetails is included in the incident metadata, it is not automatically parsed or accessible within the Logic App unless explicitly extracted. Unlike predefined entities such as Account, Mailbox, or IP, custom details are treated as nested objects within the incident's JSON structure and are not exposed as dynamic content by default in Logic Apps.

To make the UPN accessible, you can try adding a Parse JSON action immediately after the Get incident action in your Logic App. In this step, you should target body

('Get_incident')?['properties']?['customDetails']

as the content and provide a schema that defines the UPN as a string. Once parsed, the UPN becomes available as dynamic content or can be accessed using the expression

@body('Parse_JSON')?['UPN']

This enables the To field in the email action to correctly receive the intended email address. Before this, it's important to verify that the UPN field is actually present in the incident JSON under customDetails by inspecting a generated incident in Sentinel. If the UPN is missing, ensure the KQL is part of an active Analytics Rule and is correctly structured.

If you have any questions or query, please let us know.

Answer 2

I finally got it to work, using the proper dynamic expression that parses the content of Custom Details. I declared an array in the Schema since we might have multiple users affected by an incident. Then in the filed To, I use the content of the array (with first, select the element [0] of the array, the first UPN ) and now its sending emails to affected users using the correct UPN

We can close the thread now if you wish, thank you !