Cloud app security Playbook to Power Automate - details

[cstack]

In Cloud App Security I have routed alerts to Teams with the policy notification feature and it posts a nice detailed message with links back to the alert in cloud app security.  I want to instead send the alert to Power Automate and create a filter and some actions including posting to Teams but only if the alert meets my filter conditions.  I can get this to work BUT I cannot seem to get the alert details.  The alert if for New Group Created and I am unable to get the actual detail with the group name like I get if I let Cloud App Security post directly to Teams via a channel email address.  I attached what the alert looks like if I do  not use power automate and have it post directly from Cloud App Security.  Anyone know how I can get the same info into my Flow so it posts the same info to Teams?  I am really only missing the Activity with the name of the group that was created. 

[powercorner]

Hey cstack,

I think there is no ootb connector for your problem. 

But I think you could work around this in scanning your incoming mails by the power automate flow and trigger when a mail from the "Cloud App Security" pops in. Then you can do your filter magic inside the flow and post the infos to teams, or whereevery you need. 
Would this fit your goal?

With regards,

Kevin

[cstack]

@powercorner - I will give this a try and get back to you if I can get it to work.  Many thanks

[powercorner]

@cstack you are welcome 🙂 Just continue the post here if it doesnt work

[cstack]

@powercorner - I am able to connect to the Cloud App notification email from Power Automate without any trouble and know I can use filtering on the body of the email BUT I need to filter on  this line in BOLD the Cloud App notification of the policy match

A new match was detected for your 'New Group Created' policy.

Activity:

Create group: group JCCU My Group Name Test

We are a non-profit and cannot afford to get everyone on Premium AAD for group naming conventions but instead have a policy to route group creating activity to a Teams channel for IT staff to review.  We then fix the misnamed groups manually.  I am just trying to automate this a little more by not posting to Teams if the group name meets our rules.  The rules allow for about 10 different beginnings including the one I have in the example above JCCU.  So the above group should get a post to teams that says group name correct ....or something similar and the Alert should be dismissed/closed in Cloud App Security via power automate.  If the group name does not begin with the handful of rules we have I want the post to say PLEASE rename the group to a proper name and close the Alert.  Is it possible to filter on 10 different strings in Power Automate from the email.  The 10 different beginnings like JCCU could also be included in the email address of the person who created the group so I cannot just filter for contains and the 10 allowed beginnings since the group could be wrong but it would see JCCU in the email address of the person creating the group and not flow properly.  These are the allowed group beginnings.  How do I conditional test for Body contains 'Create group: group XX(XX)' where the Xes represent the below list

 Not sure this is possible since it is a workaround to paying for Premium AAD.  Any suggestions would be appreciated.

Christine Stack

IT Director

Jesuit Conference of Canada and the USA

1016 16th Street NW, suite 400

Washington, D.C. 20036

[powercorner]

Hey @cstack ,

sorry for my late response, I had to deal with some other problems in the technet and I saw your answer late.

Okay so what I understood is that your flow is now triggered by incoming emails.

And now you have the problem with filtering the right information.

So the information you are trying to filter is not inside your subject of your mail isnt it?

Cause If the info to filter would be inside the subject you could directly filter it in the trigger of the flow in the "advanced options of the trigger".

But in your case it looks like you need to get the information from the body right?

So technically you could work with the "contains" function and combine it with conditions.

You would need to create a condition inside your flow for every group inside your list.

And if you have a positive condition you could continue with the processing.

I hope I explained myself understandable ^^

And sorry for the german/english mix inside the screenshots. I had troubles with my browser language ^^.

If you have any more questions, I am here for you 🙂

With regards,

Kevin