Actions31
- Instance Actions
- Alert Rule Actions
- Automation Rule Actions
- Incident Actions
- Incident Comment Actions
- Query Actions
Incident → Get
AI-generatedOverview
This node operation retrieves detailed information about a specific incident from Microsoft Sentinel. It is useful for security analysts and IT professionals who need to fetch incident data, including optional related alerts, comments, and entities, to investigate and respond to security events. For example, a user can get an incident by its UUID and choose to include related alerts and comments for a comprehensive view.
Use Case Examples
- Fetch an incident by its ID to review its details.
- Retrieve an incident along with its related alerts and comments for thorough analysis.
Properties
| Name | Meaning |
|---|---|
| Sentinel Instance | The Microsoft Sentinel instance to use, specified by subscription ID, resource group, and workspace name, or by URL or selection from a list. |
| Incident ID | The UUID of the incident to retrieve. |
| Options | Additional options to customize the incident retrieval, such as including related alerts, comments, entities, simplifying the response, or splitting results. |
Output
JSON
incident- The main incident data retrieved from Microsoft Sentinel.alerts- Related alerts included if the option is enabled.comments- Comments related to the incident if requested.entities- Entities related to the incident if requested.
Dependencies
- Requires Microsoft Sentinel API access with OAuth2 authentication.
Troubleshooting
- Ensure the Incident ID is a valid UUID format; otherwise, the request will fail.
- Verify the Sentinel Instance details are correctly formatted or selected to avoid connection errors.
- If including related data (alerts, comments, entities), large responses may cause timeouts; adjust timeout settings accordingly.
Links
- Microsoft Sentinel Documentation - Official documentation for Microsoft Sentinel, including API references and incident management.