Microsoft Sentinel icon

Microsoft Sentinel

Consume the Sentinel API

Actions31

Automation Rule → Get

AI-generated

Overview

This node operation retrieves a specific Automation Rule from a Microsoft Sentinel instance using its UUID. It is useful for scenarios where you need to fetch detailed information about a particular automation rule configured in Sentinel, such as for monitoring, auditing, or integration purposes.

Use Case Examples

  1. Fetch an automation rule by its ID to review its configuration.
  2. Retrieve automation rule details to trigger further workflows based on rule properties.

Properties

Name Meaning
Sentinel Instance The Microsoft Sentinel instance to use, specified by subscription ID, resource group, and workspace name, or by an Azure Portal/Management URL.
Automation Rule ID The UUID of the automation rule to retrieve.
Options Additional options for the request, such as whether to return a simplified version of the response.

Output

JSON

  • id - The unique identifier of the automation rule.
  • name - The name of the automation rule.
  • type - The resource type of the automation rule.
  • properties
    • displayName - The display name of the automation rule.
    • description - Description of the automation rule.
    • enabled - Indicates if the automation rule is enabled.
    • order - The order of the automation rule execution.
    • conditions - Conditions that trigger the automation rule.
    • actions - Actions performed by the automation rule.

Dependencies

  • An API key credential for Microsoft Sentinel OAuth2 authentication

Troubleshooting

  • Ensure the Automation Rule ID is a valid UUID format; otherwise, the request will fail.
  • Verify that the Sentinel Instance details are correctly formatted and accessible.
  • If the node returns raw data unexpectedly, check the 'Simplify' option setting to control response format.
  • Network or authentication errors may occur if the OAuth2 credentials are invalid or expired; re-authenticate if needed.

Discussion