Connections.json

{
  "type": "Microsoft.Web/connections",
  "apiVersion": "2016-06-01",
  "name": "azureSentinel",
  "location": "[resourceGroup().location]",
  "properties": {
    "displayName": "azureSentinel",
    "customParameterValues": {},
    "api": {
      "id": "[concat('/subscriptions/',subscription().subscriptionId, '/providers/Microsoft.Web/locations/westeurope/managedApis/', 'azureSentinel')]"
    },
    "parameterValues": {
      "token:clientId": "CLIENT ID",
      "token:clientSecret": "CLIENT SECRET",
      "token:TenantId": "[subscription().tenantId]",
      "token:grantType": "client_credentials"
    }
  }
}

sentinel-logicApp.azuredeploy.json

 {
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "logicAppName": {
      "type": "string",
      "metadata": {
        "description": "Provide a name for the Logic App"
      }
    },
    "clientId": {
      "type": "string",
      "metadata": {
        "description": "Provide the client(APP) ID, this APP ID need to have at least read permission on the Azure Log Analyics/Sentinel resource"
      }
    },
    "clientSecret": {
      "type": "securestring",
      "metadata": {
        "description": "Provide the generated password for the client (App)"
      }
    }
  },
  "variables": {
    "ConnectionName": "azuresentinel"
  },
  "resources": [
    {
      "type": "Microsoft.Web/connections",
      "apiVersion": "2016-06-01",
      "name": "[variables('ConnectionName')]",
      "location": "[resourceGroup().location]",
      "properties": {
        "displayName": "[variables('ConnectionName')]",
        "customParameterValues": {
        },
        "api": {
          "id": "[concat('/subscriptions/',subscription().subscriptionId, '/providers/Microsoft.Web/locations/westeurope/managedApis/', variables('ConnectionName'))]"
        },
        "parameterValues": {
          "token:clientId": "[parameters('clientId')]",
          "token:clientSecret": "[parameters('clientSecret')]",
          "token:TenantId": "[subscription().tenantId]",
          "token:grantType": "client_credentials"
        }
      }
    },
    {
      "type": "Microsoft.Logic/workflows",
      "apiVersion": "2017-07-01",
      "name": "[parameters('logicAppName')]",
      "location": "[resourceGroup().location]",
      "dependsOn": [
        "[resourceId('Microsoft.Web/connections', variables('ConnectionName'))]"
      ],
      "identity": {
        "type": "SystemAssigned"
      },
      "properties": {
        "state": "Enabled",
        "definition": {
          "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
          "contentVersion": "1.0.0.0",
          "parameters": {
            "$connections": {
              "defaultValue": {
              },
              "type": "Object"
            }
          },
          "triggers": {
            "When_a_response_to_an_Azure_Sentinel_alert_is_triggered": {
              "type": "ApiConnectionWebhook",
              "inputs": {
                "body": {
                  "callback_url": "@{listCallbackUrl()}"
                },
                "host": {
                  "connection": {
                    "name": "@parameters('$connections')['azuresentinel']['connectionId']"
                  }
                },
                "path": "/subscribe"
              }
            }
          },
          "actions": {
            "Alert_-_Get_incident": {
              "runAfter": {
              },
              "type": "ApiConnection",
              "inputs": {
                "host": {
                  "connection": {
                    "name": "@parameters('$connections')['azuresentinel']['connectionId']"
                  }
                },
                "method": "get",
                "path": "/Cases/@{encodeURIComponent(triggerBody()?['SystemAlertId'])}/@{encodeURIComponent(triggerBody()?['WorkspaceSubscriptionId'])}/@{encodeURIComponent(triggerBody()?['WorkspaceId'])}/@{encodeURIComponent(triggerBody()?['WorkspaceResourceGroup'])}"
              }
            }
          },
          "outputs": {
          }
        },
        "parameters": {
          "$connections": {
            "value": {
              "azuresentinel": {
                "connectionId": "[resourceId('Microsoft.Web/connections', variables('ConnectionName'))]",
                "connectionName": "[variables('ConnectionName')]",
                "id": "[concat('/subscriptions/',subscription().subscriptionId, '/providers/Microsoft.Web/locations/westeurope/managedApis/', variables('ConnectionName'))]"
              }
            }
          }
        }
      }
    }
  ],
  "outputs": {
  }
}