Actions31
- Instance Actions
- Alert Rule Actions
- Automation Rule Actions
- Incident Actions
- Incident Comment Actions
- Query Actions
Incident Comment → Delete
AI-generatedOverview
This node operation deletes a specific comment from an incident in Microsoft Sentinel. It is useful for managing and maintaining incident comments by removing outdated or irrelevant comments. For example, a security analyst might use this operation to delete a comment that was added by mistake or is no longer applicable to the incident.
Use Case Examples
- Deleting a comment from a security incident to keep the incident notes relevant and up-to-date.
- Removing a comment that contains incorrect information from an incident in Microsoft Sentinel.
Properties
| Name | Meaning |
|---|---|
| Sentinel Instance | The Microsoft Sentinel instance to use, specified by subscription ID, resource group, and workspace name, or by an Azure Portal/Management URL. |
| Incident ID | The UUID of the incident from which the comment will be deleted. |
| Comment ID | The UUID of the comment to delete from the incident. |
| Debug | Enable or disable debug mode for the node. |
| Request Options | Additional request options such as batching, SSL certificate validation, proxy settings, and timeout configuration. |
Output
JSON
success- Indicates whether the comment deletion was successful.statusCode- HTTP status code returned by the API after attempting to delete the comment.
Dependencies
- Requires an OAuth2 API credential for Microsoft Sentinel to authenticate requests.
Troubleshooting
- Common issues include invalid or missing Incident ID or Comment ID, which will cause the deletion to fail.
- Incorrect Sentinel instance details can lead to authentication or resource not found errors.
- Timeouts or network issues may cause the request to fail; adjusting the timeout or proxy settings can help resolve these.