Overview

This node creates a new incident in Microsoft Sentinel. It is useful for security operations teams to log and track security incidents with details such as title, severity, status, description, activity times, labels, and ownership. For example, it can be used to automatically create an incident when a suspicious alert is detected, helping streamline incident management workflows.

Use Case Examples

1. Create a high severity incident titled 'Suspicious Login Attempt' with status 'New' and assign it to a security analyst.
2. Log an informational incident with detailed description and labels for malware detection.

Properties

Output

JSON

• id - The unique identifier of the created incident.
• title - The title of the created incident.
• severity - The severity level of the created incident.
• status - The status of the created incident.
• description - The description of the created incident.
• firstActivityTimeUtc - The first activity time in UTC for the incident.
• lastActivityTimeUtc - The last activity time in UTC for the incident.
• labels - Labels associated with the incident.
• owner - The owner of the incident.

Dependencies

• Microsoft Sentinel API
• OAuth2 API credentials for Microsoft Sentinel

Troubleshooting

• Ensure the Sentinel instance is correctly specified in the required format or URL to avoid validation errors.
• Verify that the OAuth2 credentials for Microsoft Sentinel are correctly configured and have necessary permissions.
• If the incident ID is provided, ensure it is a valid UUID format; otherwise, a new UUID will be generated automatically.
• Check network connectivity and proxy settings if requests fail or time out.
• If SSL certificate validation fails, consider enabling the option to ignore SSL issues, but only if safe to do so.

Links

• Microsoft Sentinel Incident Overview - Official documentation on managing incidents in Microsoft Sentinel.
• Microsoft Sentinel Incidents API - API reference for creating or updating incidents in Microsoft Sentinel.