Bugs on Microsoft Azure Sentinel since this 25/08 UK morning

Question

Hi Microsoft Team,

Various bugs on Microsoft Azure sentinel are noticed since morning 25/08.

1. Entity mappings are broken and logic apps not able to retrieve values for sentinel incident trigger (private preview) that use methods GetHost, GetIP, Get URL, Getfile hash etc.
2. when editing a workbook and saving it.. instead of saving the existing workbook its just creating duplicate workbook.

Azure Sentinel Team - Can you look into this issue as this must be affecting globally.

Thanks

Answer 1

@Prashanthkumar Basalahalli V , anonymous user, @Olivier
Thank you all for reaching out and posting to this thread!

I've reached out to our Azure Sentinel team and will update as soon as possible. Additionally, I was able to find some Known issues and limitations with the Azure Sentinel (Preview) Connector which I'll post below.

Cannot trigger a Logic App called by an Azure Sentinel trigger using the "Run Trigger" button
A user cannot use the Run trigger button on the Overview blade of the Logic Apps service to trigger an Azure Sentinel playbook.

Azure Logic Apps are triggered by a POST REST call, whose body is the input for the trigger. Logic Apps that start with Azure Sentinel triggers expect to see the content of an Azure Sentinel alert or incident in the body of the call. When the call comes from the Logic Apps Overview blade, the body of the call is empty, and therefore an error is generated.

These are the only proper ways to trigger Azure Sentinel playbooks:

• Manual trigger in Azure Sentinel
• Automated response of an analytics rule (directly or through an automation rule) in Azure Sentinel
• Use "Resubmit" button in an existing Logic Apps run blade
• Call the Logic Apps endpoint directly (attaching an alert/incident as the body)

Thank you for your time and patience throughout this issue.

Answer 2

@DebacManikandan-8212, and @Dave Anderson
Thank you both for following up on this!

I received an update from our engineering team, and this is a known issue on the duplicate entry of workbooks, and is being worked on with no ETA yet. The workaround for now, would be to ignore the duplicate saved workbook(s).

Thank you all for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.