azure-logic-appsazure-sentinel

Azure Sentinel Incident Trigger in Logic Apps Automation Delay

I have a logic app that uses the sentinel incident trigger. I'm noticing there is a delay of 5-8 minutes before the logic app actually triggers on all incidents.

Is there something i've set up wrong?

enter image description here (Time displayed on the left is Melbourne Australia time +10)

Below is the automation trigger ive set up in Microsoft Sentinel. It's order position is 1. enter image description here

Is this expected behavior? How do i debug this?

Solution

  • https://github.com/Azure/Azure-Sentinel/issues/9890

    I see an answer here that says:

    "The Creation time which you see after the Incident get generated it is Incident creation time in Defender, not the incident created into the sentinel. As mentioned into the MS doc, the sync having up to 10 min of delay. So once the Incident is fully created into the Sentinel, the automation rule will run without having any delay."

    can someone confirm this.......