Actions31
- Instance Actions
- Alert Rule Actions
- Automation Rule Actions
- Incident Actions
- Incident Comment Actions
- Query Actions
Incident Comment → Create
AI-generatedOverview
This node operation creates a new comment on a specified incident within a Microsoft Sentinel instance. It is useful for adding notes, updates, or collaborative remarks to incidents tracked in Sentinel, enhancing incident management and communication.
Use Case Examples
- Adding a comment to an incident to provide additional context or updates.
- Collaborating with a security team by posting remarks on an incident for shared visibility.
Properties
| Name | Meaning |
|---|---|
| Sentinel Instance | The Microsoft Sentinel instance to use, specified by subscription ID, resource group, and workspace name, or by an Azure Portal/Management URL. |
| Incident ID | The UUID of the incident to which the comment will be added. |
| Message | The comment message content, with a maximum length of 30,000 characters. |
| Options | Additional optional parameters for the comment creation. |
Output
JSON
id- The unique identifier of the created comment.message- The content of the comment message.createdBy- Information about the user who created the comment.createdTimeUtc- The timestamp when the comment was created.etag- The Etag value for concurrency control.
Dependencies
- Requires an OAuth2 API credential for Microsoft Sentinel to authenticate requests.
Troubleshooting
- Ensure the Incident ID is a valid UUID format; invalid IDs will cause errors.
- Verify the Sentinel Instance details are correctly formatted and accessible.
- If the comment message exceeds 30,000 characters, the request will be rejected.
- Check that the OAuth2 credentials are valid and have sufficient permissions to create comments in the Sentinel workspace.