Microsoft Sentinel icon

Microsoft Sentinel

Consume the Sentinel API

Actions31

Incident Comment → Update

AI-generated

Overview

This node updates an existing comment on a Microsoft Sentinel incident. It is useful for modifying or correcting information in incident comments, ensuring that communication and documentation within the incident management process remain accurate and up-to-date. For example, a security analyst can update a comment to add new findings or clarify previous notes on an incident.

Use Case Examples

  1. Updating a comment on a Sentinel incident to correct a typo or add additional context.
  2. Modifying a comment to reflect new information discovered during incident investigation.

Properties

Name Meaning
Sentinel Instance The Microsoft Sentinel instance to use, specified by subscription ID, resource group, and workspace name, or by an Azure Portal/Management URL.
Incident ID The UUID of the incident to which the comment belongs.
Comment ID The UUID of the comment to update.
Message The updated comment message, with a maximum length of 30,000 characters.
Options Additional optional parameters for the update operation.

Output

JSON

  • id - The unique identifier of the updated comment.
  • message - The updated comment message content.
  • etag - The Etag value associated with the updated comment for concurrency control.
  • lastModifiedTimeUtc - The timestamp of when the comment was last modified.

Dependencies

  • Requires an OAuth2 API credential for Microsoft Sentinel to authenticate requests.

Troubleshooting

  • Ensure the Incident ID and Comment ID are valid UUIDs; invalid IDs will cause errors.
  • If the Etag option is used, make sure it matches the current Etag of the comment to avoid concurrency conflicts.
  • Check that the Sentinel Instance is correctly specified in one of the accepted formats (Path, URL, or List).
  • Verify network connectivity and that the OAuth2 credentials have sufficient permissions to update incident comments in Microsoft Sentinel.

Discussion