Microsoft Sentinel icon

Microsoft Sentinel

Consume the Sentinel API

Actions31

Incident Comment → Get Many

AI-generated

Overview

This node operation retrieves multiple comments associated with a specific incident in Microsoft Sentinel. It is useful for scenarios where users need to fetch and review all comments related to a security incident for analysis, auditing, or reporting purposes. For example, a security analyst might use this operation to gather all discussion threads on an incident to understand the investigation progress.

Use Case Examples

  1. Fetching all comments for a given incident ID to display in a dashboard.
  2. Retrieving incident comments to export them for compliance documentation.

Properties

Name Meaning
Sentinel Instance The Microsoft Sentinel instance to use, specified by subscription ID, resource group, and workspace name, or by providing a valid Azure Portal/Management URL.
Incident ID The UUID of the incident for which to retrieve comments.
Options Additional options to customize the response.

Output

JSON

  • comments - Array of incident comments retrieved from the Sentinel API.

Dependencies

  • Requires an OAuth2 API credential for Microsoft Sentinel to authenticate requests.

Troubleshooting

  • Ensure the Incident ID is a valid UUID; invalid IDs will cause request failures.
  • Verify the Sentinel Instance details are correctly formatted and accessible; incorrect instance information will lead to authentication or resource not found errors.
  • If the response is empty, check if the incident actually has comments or if the API permissions allow reading comments.

Discussion