Actions31
- Instance Actions
- Alert Rule Actions
- Automation Rule Actions
- Incident Actions
- Incident Comment Actions
- Query Actions
Incident Comment → Get
AI-generatedOverview
This node operation retrieves a specific comment from an incident in Microsoft Sentinel. It is useful for scenarios where you need to fetch detailed information about a particular comment associated with a security incident, such as for auditing, review, or further processing within an automation workflow.
Use Case Examples
- Fetching a comment by its UUID from a known incident to display or analyze its content.
- Retrieving incident comments to integrate with external ticketing or reporting systems.
Properties
| Name | Meaning |
|---|---|
| Sentinel Instance | The Microsoft Sentinel instance to use, specified by subscription ID, resource group, and workspace name, or by providing a valid Azure Portal/Management URL. |
| Incident ID | The UUID of the incident from which to retrieve the comment. |
| Comment ID | The UUID of the specific comment to retrieve. |
| Options | Additional options for the request. |
Output
JSON
id- The unique identifier of the comment.incidentId- The unique identifier of the incident the comment belongs to.message- The content of the comment.createdBy- Information about the user who created the comment.createdTimeUtc- The timestamp when the comment was created.lastModifiedTimeUtc- The timestamp when the comment was last modified.
Dependencies
- Microsoft Sentinel API accessed via OAuth2 authentication
Troubleshooting
- Ensure the Incident ID and Comment ID are valid UUIDs; invalid IDs will cause the request to fail.
- Verify that the Sentinel Instance details are correctly formatted and accessible; incorrect instance details will result in authentication or resource not found errors.
- If the 'Simplify' option is enabled, the response will be a simplified version; if raw data is needed, disable this option.
- Check network connectivity and proxy settings if requests time out or fail to connect.
- If SSL certificate validation issues occur, consider enabling the 'Ignore SSL Issues' option cautiously.