cancel
Showing results for 
Search instead for 
Did you mean: 
Reply
cstack
Frequent Visitor

Cloud app security Playbook to Power Automate - details

In Cloud App Security I have routed alerts to Teams with the policy notification feature and it posts a nice detailed message with links back to the alert in cloud app security.  I want to instead send the alert to Power Automate and create a filter and some actions including posting to Teams but only if the alert meets my filter conditions.  I can get this to work BUT I cannot seem to get the alert details.  The alert if for New Group Created and I am unable to get the actual detail with the group name like I get if I let Cloud App Security post directly to Teams via a channel email address.  I attached what the alert looks like if I do  not use power automate and have it post directly from Cloud App Security.  Anyone know how I can get the same info into my Flow so it posts the same info to Teams?  I am really only missing the Activity with the name of the group that was created.Screenshot 2021-04-19 151559.jpg

5 REPLIES 5
powercorner
Continued Contributor
Continued Contributor

Hey cstack,

I think there is no ootb connector for your problem. 

But I think you could work around this in scanning your incoming mails by the power automate flow and trigger when a mail from the "Cloud App Security" pops in. Then you can do your filter magic inside the flow and post the infos to teams, or whereevery you need. 
Would this fit your goal?

 

With regards,

Kevin

cstack
Frequent Visitor

@powercorner - I will give this a try and get back to you if I can get it to work.  Many thanks

powercorner
Continued Contributor
Continued Contributor

@cstack you are welcome 🙂 Just continue the post here if it doesnt work

cstack
Frequent Visitor

@powercorner - I am able to connect to the Cloud App notification email from Power Automate without any trouble and know I can use filtering on the body of the email BUT I need to filter on  this line in BOLD the Cloud App notification of the policy match

A new match was detected for your 'New Group Created' policy.
Activity:Create group: group JCCU My Group Name Test

We are a non-profit and cannot afford to get everyone on Premium AAD for group naming conventions but instead have a policy to route group creating activity to a Teams channel for IT staff to review.  We then fix the misnamed groups manually.  I am just trying to automate this a little more by not posting to Teams if the group name meets our rules.  The rules allow for about 10 different beginnings including the one I have in the example above JCCU.  So the above group should get a post to teams that says group name correct ....or something similar and the Alert should be dismissed/closed in Cloud App Security via power automate.  If the group name does not begin with the handful of rules we have I want the post to say PLEASE rename the group to a proper name and close the Alert.  Is it possible to filter on 10 different strings in Power Automate from the email.  The 10 different beginnings like JCCU could also be included in the email address of the person who created the group so I cannot just filter for contains and the 10 allowed beginnings since the group could be wrong but it would see JCCU in the email address of the person creating the group and not flow properly.  These are the allowed group beginnings.  How do I conditional test for Body contains 'Create group: group XX(XX)' where the Xes represent the below list

cstack_0-1619010313628.png

 Not sure this is possible since it is a workaround to paying for Premium AAD.  Any suggestions would be appreciated.

 

Christine Stack

IT Director

Jesuit Conference of Canada and the USA

1016 16th Street NW, suite 400

Washington, D.C. 20036

powercorner
Continued Contributor
Continued Contributor

Hey @cstack ,

 

sorry for my late response, I had to deal with some other problems in the technet and I saw your answer late.

Okay so what I understood is that your flow is now triggered by incoming emails.

 

And now you have the problem with filtering the right information.

 

So the information you are trying to filter is not inside your subject of your mail isnt it?

Cause If the info to filter would be inside the subject you could directly filter it in the trigger of the flow in the "advanced options of the trigger".

powercorner_0-1619351514540.png

But in your case it looks like you need to get the information from the body right?

So technically you could work with the "contains" function and combine it with conditions.

powercorner_1-1619351614860.png

You would need to create a condition inside your flow for every group inside your list.

And if you have a positive condition you could continue with the processing.

I hope I explained myself understandable ^^

 

And sorry for the german/english mix inside the screenshots. I had troubles with my browser language ^^.

 

If you have any more questions, I am here for you 🙂


With regards,

Kevin

Helpful resources

Announcements

Celebrating the May Super User of the Month: Laurens Martens

  @LaurensM  is an exceptional contributor to the Power Platform Community. Super Users like Laurens inspire others through their example, encouragement, and active participation. We are excited to celebrated Laurens as our Super User of the Month for May 2024.   Consistent Engagement:  He consistently engages with the community by answering forum questions, sharing insights, and providing solutions. Laurens dedication helps other users find answers and overcome challenges.   Community Expertise: As a Super User, Laurens plays a crucial role in maintaining a knowledge sharing environment. Always ensuring a positive experience for everyone.   Leadership: He shares valuable insights on community growth, engagement, and future trends. Their contributions help shape the Power Platform Community.   Congratulations, Laurens Martens, for your outstanding work! Keep inspiring others and making a difference in the community!   Keep up the fantastic work!        

Check out the Copilot Studio Cookbook today!

We are excited to announce our new Copilot Cookbook Gallery in the Copilot Studio Community. We can't wait for you to share your expertise and your experience!    Join us for an amazing opportunity where you'll be one of the first to contribute to the Copilot Cookbook—your ultimate guide to mastering Microsoft Copilot. Whether you're seeking inspiration or grappling with a challenge while crafting apps, you probably already know that Copilot Cookbook is your reliable assistant, offering a wealth of tips and tricks at your fingertips--and we want you to add your expertise. What can you "cook" up?   Click this link to get started: https://aka.ms/CS_Copilot_Cookbook_Gallery   Don't miss out on this exclusive opportunity to be one of the first in the Community to share your app creation journey with Copilot. We'll be announcing a Cookbook Challenge very soon and want to make sure you one of the first "cooks" in the kitchen.   Don't miss your moment--start submitting in the Copilot Cookbook Gallery today!     Thank you,  Engagement Team

Announcing Power Apps Copilot Cookbook Gallery

We are excited to share that the all-new Copilot Cookbook Gallery for Power Apps is now available in the Power Apps Community, full of tips and tricks on how to best use Microsoft Copilot as you develop and create in Power Apps. The new Copilot Cookbook is your go-to resource when you need inspiration--or when you're stuck--and aren't sure how to best partner with Copilot while creating apps.   Whether you're looking for the best prompts or just want to know about responsible AI use, visit Copilot Cookbook for regular updates you can rely on--while also serving up some of your greatest tips and tricks for the Community. Check Out the new Copilot Cookbook for Power Apps today: Copilot Cookbook - Power Platform Community.  We can't wait to see what you "cook" up!    

Welcome to the Power Automate Community

You are now a part of a fast-growing vibrant group of peers and industry experts who are here to network, share knowledge, and even have a little fun.   Now that you are a member, you can enjoy the following resources:   Welcome to the Community   News & Announcements: The is your place to get all the latest news around community events and announcements. This is where we share with the community what is going on and how to participate.  Be sure to subscribe to this board and not miss an announcement.   Get Help with Power Automate Forums: If you're looking for support with any part of Power Automate, our forums are the place to go. From General Power Automate forums to Using Connectors, Building Flows and Using Flows.  You will find thousands of technical professionals, and Super Users with years of experience who are ready and eager to answer your questions. You now have the ability to post, reply and give "kudos" on the Power Automate community forums. Make sure you conduct a quick search before creating a new post because your question may have already been asked and answered. Galleries: The galleries are full of content and can assist you with information on creating a flow in our Webinars and Video Gallery, and the ability to share the flows you have created in the Power Automate Cookbook.  Stay connected with the Community Connections & How-To Videos from the Microsoft Community Team. Check out the awesome content being shared there today.   Power Automate Community Blog: Over the years, more than 700 Power Automate Community Blog articles have been written and published by our thriving community. Our community members have learned some excellent tips and have keen insights on the future of process automation. In the Power Automate Community Blog, you can read the latest Power Automate-related posts from our community blog authors around the world. Let us know if you'd like to become an author and contribute your own writing — everything Power Automate-related is welcome.   Community Support: Check out and learn more about Using the Community for tips & tricks. Let us know in the Community Feedback  board if you have any questions or comments about your community experience. Again, we are so excited to welcome you to the Microsoft Power Automate community family. Whether you are brand new to the world of process automation or you are a seasoned Power Automate veteran - our goal is to shape the community to be your 'go to' for support, networking, education, inspiration and encouragement as we enjoy this adventure together.     Power Automate Community Team

Hear what's next for the Power Up Program

Hear from Principal Program Manager, Dimpi Gandhi, to discover the latest enhancements to the Microsoft #PowerUpProgram, including a new accelerated video-based curriculum crafted with the expertise of Microsoft MVPs, Rory Neary and Charlie Phipps-Bennett. If you’d like to hear what’s coming next, click the link below to sign up today! https://aka.ms/PowerUp  

Tuesday Tip | How to Report Spam in Our Community

It's time for another TUESDAY TIPS, your weekly connection with the most insightful tips and tricks that empower both newcomers and veterans in the Power Platform Community! Every Tuesday, we bring you a curated selection of the finest advice, distilled from the resources and tools in the Community. Whether you’re a seasoned member or just getting started, Tuesday Tips are the perfect compass guiding you across the dynamic landscape of the Power Platform Community.   As our community family expands each week, we revisit our essential tools, tips, and tricks to ensure you’re well-versed in the community’s pulse. Keep an eye on the News & Announcements for your weekly Tuesday Tips—you never know what you may learn!   Today's Tip: How to Report Spam in Our Community We strive to maintain a professional and helpful community, and part of that effort involves keeping our platform free of spam. If you encounter a post that you believe is spam, please follow these steps to report it: Locate the Post: Find the post in question within the community.Kebab Menu: Click on the "Kebab" menu | 3 Dots, on the top right of the post.Report Inappropriate Content: Select "Report Inappropriate Content" from the menu.Submit Report: Fill out any necessary details on the form and submit your report.   Our community team will review the report and take appropriate action to ensure our community remains a valuable resource for everyone.   Thank you for helping us keep the community clean and useful!

Users online (3,499)