Hi,

I am having an issue with creating a new automation playbook for enriching incidents via a kql query.

It looks like there is no longer a "Run query and list results" and "Run query and list results (V2), just a "Run query and list results) which if I look at the code is actually the V2 one.

I am pretty sure I solved this issue before by using the non V2 action.

I have put in my kql query which is hopefully right.

Used dynamic content for the other boxes

Incident workspace subscription id, incident workspace resource group name, Log Analytics Workspace drop-down, incident workspace workspace name.

Now I have the Time Range Type and when I press the drop-down the only option is enter custom value. In my other playbook I then enter "Set in query" and pressed tab. This now adds another drop-down for "time range" and I have tried putting things in there with no success like PT24H.

Flow:

MS sentinel incident trigger

Entites - Get Accounts (dc - Entities)

For each (dc - Accounts)

Compose 1

Compose Time Anchor (f - if(empty(outputs('compose_1')?['ApprovalTime']),triggerbody()?['object']?['properties']?['lastActicityTimeUtc'],first(outputs('compose_1')?['ApprovalTime']))

Run query and list results

Create html table (f - body('Run_query_and_list_results')?['value']

Add comment to incident V3 (f - concat('Entra sign-in check for ', items('For_each')?['Name'])

Thanks