Azure-Sentinel/Playbooks/Send-Slack-Message-Webhook

Send Slack Message Via Webhook

author: Zachi Neuman

This playbook will be sending slack with basic incidents details (Incident title, severity, tactics, link,…) when incident is created in Azure Sentinel. The playbook includes functionality to:

1. Close Incident As False Positive
2. Close Incident As Benign Positve
3. Change Incident Status To Active
4. White List Entities
   
   

Pre-requisites:

Slack application with:

1. Webhook installed 1.1 How to install webhook - https://api.slack.com/messaging/webhooks
2. Interactivity Enbaled
   
   

Deployment:

[]()

Post-deployment

Configure connections

Edit the Logic App or go to Logic app designer.

Attach the playbook

After deployment, attach this playbook to an automation rule so it runs when the incident is created. Learn more about automation rules

Screenshot

Playbook screenshoot

Email screenshot