Actions31
- Instance Actions
- Alert Rule Actions
- Automation Rule Actions
- Incident Actions
- Incident Comment Actions
- Query Actions
Incident → Delete Comment
AI-generatedOverview
This node operation deletes a specific comment from an incident in Microsoft Sentinel. It is useful for managing incident comments by removing outdated, irrelevant, or incorrect remarks associated with a security incident. For example, a security analyst might use this operation to clean up incident comments after resolving a false positive or to maintain clear communication logs within the Sentinel workspace.
Use Case Examples
- Deleting a comment from an incident to remove irrelevant information.
- Removing a mistakenly added comment from an incident to maintain accurate records.
Properties
| Name | Meaning |
|---|---|
| Sentinel Instance | The Microsoft Sentinel instance to use, specified by subscription ID, resource group, and workspace name, or by providing a valid Azure Portal/Management URL. |
| Incident ID | The UUID of the incident from which the comment will be deleted. |
| Comment ID | The UUID of the comment to be deleted from the incident. |
| Debug | Enable or disable debug mode for the node to log detailed request and response information. |
| Request Options | Additional settings for the HTTP request such as batching, SSL certificate validation, proxy configuration, and timeout duration. |
Output
JSON
success- Indicates whether the comment deletion was successful.statusCode- HTTP status code returned by the API after attempting to delete the comment.
Dependencies
- Requires an OAuth2 API credential for Microsoft Sentinel to authenticate requests.
Troubleshooting
- Ensure the Incident ID and Comment ID are valid UUIDs; invalid IDs will cause the deletion to fail.
- Verify that the Sentinel instance details are correctly specified to avoid connection errors.
- If SSL issues occur, consider enabling the 'Ignore SSL Issues' option, but be aware of security risks.
- Check API permissions to ensure the authenticated user has rights to delete incident comments in Microsoft Sentinel.