azure-logic-appsazure-sentinel

ExpressionEvaluationFailed. The execution of template action 'For_each' failed:

I get the following error when I test a flow I've created:

ExpressionEvaluationFailed. The execution of template action 'For_each' failed: the result of the evaluation of 'foreach' expression '@triggerBody()?['incidentUpdates']' is of type 'Null'. The result must be a valid array.

enter image description here

enter image description here

Does anyone have any tips on what I'm doing wrong? Thanks so much!

I am trying to implement A recurring playbook that triggers at knock-off hour every day (Mon-Friday), The paybook collects infomation about incident id , name , description , url All the incidends assigned to the analyst, projected on a HTML table and send it to one of my colleagues.

JSON output from the first action in the flow:

"headers": {

        "Connection": "Close",

        "Accept": "*/*",

        "Accept-Encoding": "gzip,deflate",

        "Accept-Language": "en",

        "Host": "management.southafricanorth.logic.azure.com",

        "Referer": "https://management.azure.com/subscriptions/17eeca6a-0dea-41e9-8fc9-f12b59cfad62/resourcegroups/ACSA_CSOC_RG/providers/Microsoft.Logic/workflows/All-incidents-in-a-given-time-frame/triggers/Microsoft_Sentinel_incident/run?api-version=2016-10-01",

        "User-Agent": "Mozilla/5.0,(Windows NT 10.0; Win64; x64),AppleWebKit/537.36,(KHTML, like Gecko),Chrome/113.0.0.0,Safari/537.36,Edg/113.0.1774.50",

        "x-ms-client-session-id": "6cfb9cdfea3248d3a41dba1f89e410ad",

        "x-ms-command-name": "Microsoft_Azure_EMA.",

        "x-ms-effective-locale": "en.en-us",

        "x-ms-client-request-id": "52e3f450-f914-46f0-9370-03e70fcda011",

        "sec-fetch-site": "same-site",

        "sec-fetch-mode": "cors",

        "sec-fetch-dest": "empty",

        "x-ms-arm-resource-system-data": "{\"lastModifiedBy\":\"lumka@phakamo.co.za\",\"lastModifiedByType\":\"User\",\"lastModifiedAt\":\"2023-05-26T11:12:11.5409557Z\"}",

        "x-ms-arm-request-tracking-id": "d4901af4-623e-4c2e-bd1a-78a0ea3be9d7",

        "x-ms-correlation-request-id": "d4901af4-623e-4c2e-bd1a-78a0ea3be9d7",

        "x-ms-routing-request-id": "SOUTHAFRICANORTH:20230526T111211Z:d4901af4-623e-4c2e-bd1a-78a0ea3be9d7",

        "x-ms-client-location": "southafricanorth",

        "x-ms-home-tenant-id": "fb62d46e-e86e-4673-ba82-b27b61d8202b",

        "x-ms-client-ip-address": "41.150.225.141",

        "x-ms-arm-service-request-id": "8ba39e8f-b89a-4d1c-ba60-0f23ebb8f715",

        "x-ms-management-group-ancestors": "fb62d46e-e86e-4673-ba82-b27b61d8202b",

        "x-ms-client-audience": "https://management.core.windows.net/",

        "x-ms-client-scope": "user_impersonation",

        "x-ms-client-acr": "1",

        "x-ms-client-app-id": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c",

        "x-ms-client-app-id-acr": "2",

        "x-ms-client-tenant-id": "506a7cb6-60b5-4cc7-8dfc-28daca27e296",

        "x-ms-client-issuer": "https://sts.windows.net/506a7cb6-60b5-4cc7-8dfc-28daca27e296/",

        "x-ms-client-object-id": "807dd4d9-6007-4cac-a771-07cf40630ad8",

        "x-ms-client-puid": "100320012670DEE5",

        "x-ms-client-alt-sec-id": "",

        "x-ms-client-principal-id": "100320012670DEE5",

        "x-ms-client-authorization-source": "RoleBased",

        "x-ms-client-identity-provider": "",

        "x-ms-client-authentication-methods": "pwd, rsa, mfa",

        "x-ms-client-principal-group-membership-source": "Token",

        "x-ms-client-principal-name": "lumka@phakamo.co.za",

        "x-ms-client-family-name-encoded": "TGFuZ2E=",

        "x-ms-client-given-name-encoded": "THVta2E=",

        "x-ms-arm-network-source": "PublicNetwork",

        "traceparent": "00-b75aaa8c8d8f63a0ea3110c0d52770a4-cae5b018000a229b-01",

        "x-ms-activity-vector": "IN.09",

        "Content-Length": "0",

        "Content-Type": "application/json"

    }

}
Solution

  • After reproducing from my end, I received the same error as yours when I tried to iterate a value in For_each loop which is null and not array.

    enter image description here

    enter image description here

    If you are unaware of the values that you are receiving in the required value that needs to be iterated, then I would recommend you to use Compose action to view the values that are received in the required value as below.

    enter image description here

    enter image description here

    You can check the values after each run from the run history from overview pane of your logic app.

    enter image description here