logic App to ingest notification of azure monitor alerte to Microsoft sentinel

Dhahri, Arwa 0

Hi,

In the alert rule configuration for Azure Monitoring, I need to set up an action group (Logic App) that will forward all alert notifications to Microsoft Sentinel. However, I require assistance with designing a Logic App that meets my needs, as I'm currently unable to create the correct design of the Logic App.

LeelaRajeshSayana-MSFT 16,601 Reputation points

2024-11-11T14:37:39.9133333+00:00

Hi @Dhahri, Arwa Greetings! I am following up to see if you got a chance to review the above response. Please let us know if you have any additional questions or need further assistance.
Dhahri, Arwa 0 Reputation points

2024-11-11T15:08:07.2466667+00:00

now if i want to create analytic Log Alerte in Monitor , i select Alerte - create Alerte- alert rule

for exemple, if a new policy Assignment was created , i select signal name

But in Actions , i`ll create a new action groupe "Logic App" that will forward all alert notifications to Microsoft Sentinel but i don have the logic app designe

i need help for the logic app designe ..
LeelaRajeshSayana-MSFT 16,601 Reputation points

2024-11-19T13:39:53.57+00:00

Hi @Dhahri, Arwa We still have not heard back from you. Just wanted to check if the answer provided below was helpful? If it answers your query, please do click Accept Answer and Yes for the answer, as it might be beneficial to other community members reading this thread. And, if you have any further query do let us know. Thank you

1 answer

LeelaRajeshSayana-MSFT 16,601 Reputation points

2024-11-09T00:51:45.43+00:00
Hi @Dhahri, Arwa Greetings! Welcome to Microsoft Q&A forum. Thank you for posting this question here.

There are couple of bindings you would need to make to finish the flow for your use case

Integrate Azure Monitor with Logic App

Use Microsoft Sentinel connector in Logic app and push the incidents or modify them as needed

To get your alert events forwarded to the Logic App you can reference the article Integrate with Logic App which provides you detailed steps on how to Create a Logic App that accepts a body in the form of JSON schema that has the format an Azure monitor alert. The article also provides the steps on how to Create an Action group and bind the Azure Monitor alerts to the above created Logic App.

Within the Logic App, you can create a connection with the Microsoft Sentinel using the connector Microsoft Sentinel (Preview) and use any of the supported actions to push the data to the Sentinel end point.

Hope this helps! If you need any additional assistance, please let us know more details on the specific alert or rule you are trying to monitor.

If the response helped, please do click Accept Answer and Yes for the answer provided. Doing so would help other community members with similar issue identify the solution. I highly appreciate your contribution to the community.
Please sign in to rate this answer.
Dhahri, Arwa 0 Reputation points

2024-11-11T14:46:07.24+00:00

for exemple if i want to create un new Activity Log Alerts , In Monito , il select "+ create" and i chose "Alerte Rule"

for exemple i want to create alerte when a new policy assignement was created

Bun in action groupe i want to create a new logic App that will forward all alert notifications to Microsoft Sentinel.

i need help for this logic App designe.

LeelaRajeshSayana-MSFT 16,601 Reputation points

2024-11-13T19:18:33.3466667+00:00

Hi @Dhahri, Arwa In order be able to link a Logic App in the action group, you would have to a create a Logic App first and then you would be able to link to the action group. Follow the steps provided in the article section Create a logic app and use the same JSON body template for the Http trigger.

Once you create the Logic app, you would be able to see it in the options to select and associate the action group with it. Please refer the below image for your reference.

Since the JSON body of the request is already configured with the expected format of the alert, in the event of an alert you can get all the information related to the alert accessing the AffectedResources variable which you might have created if you followed the article above. Please find the below image which capture the data of an activity log alert

Hope this helps. Please let us know if you have any additional questions or need further clarification.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

logic App to ingest notification of azure monitor alerte to Microsoft sentinel

1 answer

Your answer