Overview

This node operation allows users to create or update an incident in Microsoft Sentinel. It is useful for security teams to manage incidents by setting or modifying details such as the incident's title, description, severity, and status. For example, a security analyst can create a new incident when a threat is detected or update an existing incident with additional information or change its status as the investigation progresses.

Use Case Examples

1. Create a new incident with a high severity and detailed description to track a security breach.
2. Update an existing incident's status to 'Closed' after resolving the issue.

Properties

Output

JSON

• id - The unique identifier of the incident.
• title - The title of the incident.
• description - The description of the incident.
• severity - The severity level of the incident.
• status - The current status of the incident.
• customProperties - Any custom JSON properties associated with the incident.

Dependencies

• Microsoft Sentinel API with OAuth2 authentication

Troubleshooting

• Ensure the Sentinel instance is correctly specified in the required format or URL to avoid invalid format errors.
• Verify that the Incident ID (UUID) is valid when updating an existing incident.
• Check API permissions and OAuth2 credentials if authentication errors occur.
• If the response is not as expected, try toggling the 'Simplify' option to get raw data for debugging.

Links

• Microsoft Sentinel Documentation - Official documentation for Microsoft Sentinel, including incident management.