Actions31
- Instance Actions
- Alert Rule Actions
- Automation Rule Actions
- Incident Actions
- Incident Comment Actions
- Query Actions
Incident → Create or Update Comment
AI-generatedOverview
This node operation allows users to create or update comments on incidents within Microsoft Sentinel. It is useful for adding notes, updates, or additional context to security incidents tracked in Sentinel, facilitating collaboration and incident management. For example, a security analyst can add a comment to an incident to document investigation progress or findings.
Use Case Examples
- Adding a new comment to an existing incident to provide additional details about the investigation.
- Updating an existing comment on an incident to correct or expand the information provided.
Properties
| Name | Meaning |
|---|---|
| Sentinel Instance | The Microsoft Sentinel instance to use, specified by subscription ID, resource group, and workspace name, or by an Azure Portal/Management URL. |
| Incident ID | The UUID of the incident to which the comment will be added or updated. |
| Message | The content of the comment message to be created or updated. |
| Options | Additional optional parameters for the comment, including Comment ID (UUID of the comment), Etag (for concurrency control), and Simplify (whether to return a simplified response). |
Output
JSON
id- The unique identifier of the comment.message- The content of the comment message.createdBy- Information about the user who created the comment.createdTimeUtc- Timestamp when the comment was created.lastModifiedTimeUtc- Timestamp when the comment was last modified.
Dependencies
- Requires an OAuth2 API credential for Microsoft Sentinel to authenticate requests.
Troubleshooting
- Ensure the Incident ID is a valid UUID; otherwise, the API call will fail.
- If updating a comment, provide the correct Comment ID and Etag to avoid concurrency errors.
- Verify the Sentinel Instance format is correct according to the selected mode (Path, URL, or List).
- Check network connectivity and API permissions if requests fail.