Send Email To Create Incident in Sentinel

This post is inspired by MS Ignite 2022. There was a new announcement about the creation on Microsoft Sentinel Incident Creation.

This article led tool is an extension to the same.

In a organization there might be Security Incident occurring to the resources where Security is not tightened up yet. So an email address can be whistle blower here. An suspicious activity happens this can be reported over an email to a dedicated email address.

And a basic logic app attached to the email can create a Incident in Microsoft Sentinel with a dedicated email subject.

Here is a ready to deploy template available to avail this feature.

Here are next steps

Deployment -> Configuration -> Post Configuration -> Test

Deployment

Configuration

Once deployed please validate the connection

Microsoft Sentinel Connection -

Post Configuration

After successful configuration the logic app will look like this

Test

1. Send an email

Incident created

Thank you for using the tool. Feel free to share you thoughts.