azureazure-automationazure-diagnosticsazure-sentinel

Azure Sentinel: Be notified when a playbook run fails or playbook action is disconnected

Within Azure Sentinel, I have several automation rules set up that respond with various playbooks/logic apps.

I want to be notified or know how to search the logs to find all the

  1. failed runs
  2. failed actions (by playbooks/logicapps) and
  3. when a playbook connection is disconnected (see screenshot below). enter image description here

The closest I've gotten to this is via azurediagnostics logs but Im noticing this only captures less than 1% of the logic apps in my environment.

AzureDiagnostics 
    | where OperationName contains "Microsoft.Logic"
    | extend OperationType = tostring(split(OperationName,'/')[2])
    | extend LogicApp = tostring(split(ResourceId,'/')[8])
    | extend IncidentNumber = toint(extract(@"[a-f0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}\_(\d+)", 1, correlation_clientTrackingId_s))
    | summarize Resource = strcat_array(make_set(Resource),', '),
     status_s = strcat_array(make_set(status_s),', ')  by LogicApp, IncidentNumber, OperationType, Level
Solution

  • You can create an alert rule on a logic app: enter image description here