Assign Microsoft Sentinel Responder role to the Playbook's managed identity.
Go to your Logic App > Identity > Add Azure role assignments > Add Microsoft Sentinel Responder
If consumption plan is used make sure the ip Address from Logic Apps that region are accesible.
See https://www.microsoft.com/en-us/download/details.aspx?id=56519 and add the Whitelist.
Deploy with incident trigger (recommended)
After deployment, attach this playbook to an automation rule so it runs when the incident is created.
Learn more about automation rules
- used to send incidents to Arcanna and await inference results
- used to automatically propagate feedback to Arcanna once an incident was closed in Sentinel