You have an Azure subscription that uses Microsoft Defender for Cloud and contains an Azure...

To launch a Logic App from a Microsoft Defender for Cloud alert, you create a Defender for Cloud automation resource and attach a Logic App action. In ARM, this is modeled with the resource type Microsoft .Security/automations . Its properties include isEnabled , scopes , sources (for alert filters), and actions —where actionType is LogicApp . For Logic App actions, Defender for Cloud needs the Logic App’s manual trigger callback URL . The ARM pattern uses:

listC allbackURL(resourceId(subscriptionId, resourceGroupName, ' Microsoft.Logic/workflows/ < workflowName > /triggers/manual ' ), ' 2019-05-01 ' ).value

Hence, the path segment inserted between .../workflows/ and the trigger name is triggers (because the callback URL is retrieved for the manual trigger of the workflow).

So the two correct selections to wire up app1 to run when a selected Defender for Cloud alert fires are:

Set the ARM resource type to Microsoft.Security/automations .

In the callback URL construction, append triggers (… /workflows/ < app1 > /triggers/manual ).