Microsoft Sentinel icon

Microsoft Sentinel

Consume the Sentinel API

Actions31

Incident → Delete

AI-generated

Overview

This node operation deletes a specific incident in Microsoft Sentinel. It is useful for scenarios where you need to programmatically remove incidents from your Sentinel workspace, such as cleaning up resolved or irrelevant incidents automatically.

Use Case Examples

  1. Automatically delete incidents that are no longer relevant after investigation.
  2. Remove test incidents created during development or testing phases.

Properties

Name Meaning
Sentinel Instance The Sentinel instance to use, specified by subscription ID, resource group, and workspace name, or by providing a valid Azure Portal/Management URL.
Incident ID The UUID of the incident to delete, required to identify the specific incident.
Debug Enable debug mode for the node to log detailed request and response information.
Request Options Additional request options such as batching, ignoring SSL issues, proxy settings, and timeout configuration.

Output

JSON

  • id - The unique identifier of the deleted incident.
  • name - The name of the deleted incident.
  • type - The resource type of the deleted incident.
  • properties - Details and properties of the deleted incident returned by the API.

Dependencies

  • Microsoft Sentinel API
  • An OAuth2 API credential for authentication

Troubleshooting

  • Ensure the Incident ID is a valid UUID format; otherwise, the API will reject the request.
  • Verify that the Sentinel Instance details are correctly formatted and accessible with the provided credentials.
  • If the node returns authentication errors, check the OAuth2 credential configuration and token validity.
  • Timeout errors may occur if the network is slow or the API is unresponsive; adjust the timeout setting accordingly.

Links

Discussion