❌

Reading view

There are new articles available, click to refresh the page.

Exporting a list of all incidents from Sentinel

I'm trying to export a csv of all the incidents ever registered in Sentinel in my org. This covers 2+ years of Sentinel usage. I did some digging and it turns out you cannot export data from the Threat Mgmt > Incidents tab. You can however export a table of incidents from Log Analytics by SecurityIncident query (set the time frame to the earliest data possible).

So I did exactly that and set the display count to "max limit". Each time, the query only outputs a list going back 90 days in time. Is there a data retention limit in Log Analytics that doesn't allow you to view or export incidents longer than 90 days?

Is there any other way I can go about exporting ALL incidents registered in Sentinel?

Thanks!

submitted by /u/Nice_Bag3423
[link] [comments]

Sentinel Incident to Azure OpenAI Connector in Logic Apps

Sentinel Incident to Azure OpenAI Connector in Logic Apps

Hi,

I want to create a workflow in logic apps such that whenever a new incident is registered by Sentinel, this logic app is activated (this logic app playbook is listed within the relevant automation rule in Sentinel automations). The incident's info should be sent to a specific copilot studio agent (created and deployed in copilot studio) OR to an Azure OpenAI LLM for some post-processing (detailed prompt is included within the agent aspect in my logic apps flow below, but I don't think adding this "agent" was the correct move).

1) I don't see any CoPilot Studio connectors in Logic Apps as I do in Power Automate. Am I searching for the incorrect keywords, connectors or is this logic apps --> copilot studio agent connectivity not possible yet?

2) Without waiting around for a Sentinel incident to be registered to test this flow, how can I run a simple unit test on it? The "run with payload" option in the flow's designer window is greyed out for me, any ideas as to why?

3) What would be the actions in a flow that takes the Sentinel incident info (automation rule name, findings, user id, timestamp, id address and so on) and passes it to an Azure OpenAI LLM? If anyone has any experience with this, pointers to any resources you used to assemble this connection successfully would be very useful!

https://preview.redd.it/4aojf0wrn6ug1.png?width=382&format=png&auto=webp&s=60acd8e274af55353a0fb489169182fc827a2102

Thanks!

submitted by /u/Nice_Bag3423
[link] [comments]
❌