Azure-Sentinel VS azure-docs

Azure-Sentinel/Playbooks/CreateIncident-SharedMailbox at master · Azure/Azure-Sentinel · GitHub

They recently reorganized the GitHub: https://github.com/Azure/Azure-Sentinel/blob/master/Workbooks/LogSourcesAndAnalyticRulesCoverage.json

Have you checkout out the azure playbook templates? https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks

The best option I could find so far is inferring the format by reading the source code at https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/AzureFirewall/AzureFirewallNetworkRule.kql.

There is a ton on Github. Have a look here -> https://github.com/Azure/Azure-Sentinel/wiki

Also see the Sentinel repository on GitHub for a ton of queries to reference: https://github.com/Azure/Azure-Sentinel

All the json files are stored in MS Sentinels github repo: https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks. You do not need to export them yourself. You can copy the raw json file from the repository.

here you can find various other types: https://github.com/Azure/Azure-Sentinel/tree/master/Parsers

Explained here: https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/backup/backup-azure-alternate-dpm-server.md

Official doc on runbook limitations: https://github.com/MicrosoftDocs/azure-docs/blob/main/includes/azure-automation-service-limits.md

I dont think that works:

    > git clone --depth 1 https://github.com/MicrosoftDocs/azure-docs

Does anyone have any idea why this is? I found a github issue that basically describes the issue as well but there is no satisfying solution. Can you really not use native azure monitoring solutions if you migrate your VMs to azure? That seems hard to believe and I hope I'm just missing something. I'm very thankful for any advice at this point.

It appears that there is a 512kb payload limit with runbook webhooks, which I can only find mention of on this git file:https://github.com/MicrosoftDocs/azure-docs/blob/main/includes/azure-automation-service-limits.mdThe data I was including in the web activity body appears to be just under this limit and would trigger the runbook without issue. But with the extra data webhook activities include in the body it puts it over the limit and never triggers it. Unfortunately Data Factory doesn't handle this situation properly and the activity runs indefinitely until you cancel it (despite the timeout configured).The work around for me was to add a foreach activity and put the webhook activity inside of that.