Incidents - Run Playbook

Service:

Sentinel

API Version:

2024-09-01

Triggers playbook on a specific incident

POST https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentIdentifier}/runPlaybook?api-version=2024-09-01

URI Parameters

Name	In	Required	Type	Description
incidentIdentifier	path	True	string	Incident ID
resourceGroupName	path	True	string	The name of the resource group. The name is case insensitive.
subscriptionId	path	True	string uuid	The ID of the target subscription. The value must be an UUID.
workspaceName	path	True	string	The name of the workspace. Regex pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
api-version	query	True	string	The API version to use for this operation.

Request Body

Name	Type	Description
requestBody	ManualTriggerRequestBody	Describes the request body for triggering a playbook on an incident.

Responses

Name	Type	Description
204 No Content		Success
Other Status Codes	CloudError	Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

Incidents_RunPlaybook

Sample request

HTTP

POST https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/incidents/73e01a99-5cd7-4139-a149-9f2736ff2ar4/runPlaybook?api-version=2024-09-01

Sample response

Status code:

204

Definitions

Name	Description
CloudError	Error response structure.
CloudErrorBody	Error details.
ManualTriggerRequestBody	Describes the request body for triggering a playbook on an incident.

CloudError

Error response structure.

Name	Type	Description
error	CloudErrorBody	Error data

CloudErrorBody

Error details.

Name	Type	Description
code	string	An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
message	string	A message describing the error, intended to be suitable for display in a user interface.

ManualTriggerRequestBody

Describes the request body for triggering a playbook on an incident.

Name	Type	Description
logicAppsResourceId	string	The resource id of the playbook resource.
tenantId	string	The tenant id of the playbook resource.