Microsoft Sentinel icon

Microsoft Sentinel

Consume the Sentinel API

Actions31

Incident → Add Label

AI-generated

Overview

This node operation adds labels to a specified incident in Microsoft Sentinel. It is useful for categorizing or tagging incidents with relevant labels to improve incident management and tracking. For example, security analysts can add labels like 'suspicious' or 'malware' to incidents to quickly identify their nature.

Use Case Examples

  1. Adding labels 'suspicious' and 'malware' to an incident with a given UUID to mark it for further investigation.
  2. Tagging incidents with custom labels to organize and filter them in Microsoft Sentinel.

Properties

Name Meaning
Sentinel Instance The Microsoft Sentinel instance to use, specified by subscription ID, resource group, and workspace name, or by an Azure Portal/Management URL.
Incident ID The UUID of the incident to which labels will be added.
Labels Comma-separated labels or a JSON array of labels to add to the incident.
Options Additional options for the operation, including 'Force Update' to bypass etag validation and 'Simplify' to return a simplified response.

Output

JSON

  • id - The unique identifier of the incident.
  • name - The name of the incident.
  • type - The type of the resource, typically 'incident'.
  • properties
    • labels - The updated list of labels associated with the incident.
    • status - The current status of the incident.
    • severity - The severity level of the incident.

Dependencies

  • Requires an OAuth2 API credential for Microsoft Sentinel to authenticate requests.

Troubleshooting

  • Ensure the Incident ID is a valid UUID format; otherwise, the request will fail.
  • Labels must be provided either as a comma-separated string or a valid JSON array; invalid formats may cause errors.
  • If 'Force Update' is not enabled, etag validation may prevent updates if the incident has changed since last retrieval.
  • Check that the Sentinel Instance is correctly specified in one of the accepted formats to avoid connection errors.

Discussion