Microsoft Graph Security trigger (On all new alerts) Possible bug?

(0) Share

Report

Posted on by JimmyW

2,563

Using the trigger: Microsoft Graph Security, On all new alerts

I filter it to only trigger on IPC alerts, this works fine.

I send the user an adaptive card for the IPC alert, where the user can select if they are compromised or not.

In the Responds flow for the adaptive card I then set the Risky User in Azure status to dismissed or Compromised. Everything up until now works great.

I then use the action Microsoft Graph Security: Update Alert

As soon as the Alert is updated, for example I set the status of the alert to completed, or add a tag or comment, then the first flow is triggered again, this should not happen, it is not a new alert.

This means the Microsoft Graph Security, On all new alerts is triggering when an alert status is updated also or anything changes in the alert, this is for me not expected behavior as it creates a loop, the user respond to using the adaptive card the Alert status is updated and the user gets the same email in a loop.

All responses (6)

Answers (0)

JimmyW 2,563 on at

Like (0)

Report

Re: Microsoft Graph Security trigger (On all new alerts) Possible bug?

Should only be triggered when the value of the status is "newAlert"

Currently it is also triggering on

"status": "resolved", "status": "inProgress", "status": "unknown",

Workaround to fix it is to add a trigger condition on your own.

@equals(triggerOutputs()?['body/value']?[0]?['status'], 'newAlert')
JimmyW 2,563 on at

Like (0)

Report

Re: Microsoft Graph Security trigger (On all new alerts) Possible bug?

But I'm pretty sure this is a bug and I do have a workaround, but I can replicate the issue over and over again.

@VictorIvanidze Thank you for trying 🙂
VictorIvanidze 12,207 on at

Like (0)

Report

Re: Microsoft Graph Security trigger (On all new alerts) Possible bug?

Sorry I temporary unable to use Premium connectors - maybe somebody else will help.
JimmyW 2,563 on at

Like (0)

Report

Re: Microsoft Graph Security trigger (On all new alerts) Possible bug?

Bumping this
JimmyW 2,563 on at

Like (0)

Report

Re: Microsoft Graph Security trigger (On all new alerts) Possible bug?

@VictorIvanidze I can post my entire flow but you can replicate the issue by just using the steps below, as soon as you do an Update on any Alert the trigger for Microsoft Graph Security, On all new alerts is triggered, even thou this is not a new alert.
VictorIvanidze 12,207 on at

Like (1)

Report

Re: Microsoft Graph Security trigger (On all new alerts) Possible bug?

Could you show your flow?