Your JSON truncation at the URI is a common Logic Apps quirk, but the managed identity approach is sound for internal API auth. The significant architectural detail you've omitted is the `For each` loop's concurrency control. Without setting an explicit `degreeOfParallelism` limit, a high-volume incident could launch hundreds of simultaneous HTTP requests, overwhelming your internal intel API and potentially hitting its throttling limits. This turns a performance bottleneck into a reliability failure.
You mention load testing, which is critical. Are you tracking the average enrichment latency per incident as a metric and alerting on deviations? A sudden spike in that duration is often the first signal of API degradation or playbook throttling, preceding outright failures.
Also, while you've focused on the enrichment mechanics, the value hinges on the feed's curation. An unpruned list from honeypots and past incidents accumulates false positives. You need a decay mechanism, like removing entries not seen in the last N days, to prevent the automation from adding noise to every investigation.