Overview

This node operation fetches alerts related to a specific incident in Microsoft Sentinel. It is useful for security analysts or IT professionals who want to retrieve detailed alert information associated with an incident for investigation or reporting purposes. For example, after identifying a security incident, a user can use this operation to get all alerts linked to that incident to understand the scope and details of the security event.

Use Case Examples

1. Retrieve all alerts for a given incident ID to analyze the security events triggering the incident.
2. Fetch alerts to correlate with other incident data for comprehensive incident management.

Properties

Output

JSON

• alerts - Array of alert objects related to the specified incident.

Dependencies

• Microsoft Sentinel API with OAuth2 authentication

Troubleshooting

• Ensure the Incident ID is a valid UUID; invalid IDs will cause request failures.
• Verify the Sentinel Instance details are correctly formatted and accessible.
• Check API permissions and OAuth2 credentials to ensure the node can access the Sentinel API.
• If results are unexpectedly empty, confirm that the incident has associated alerts in Microsoft Sentinel.

Links

• Microsoft Sentinel Documentation - Official documentation for Microsoft Sentinel, including API references and usage guides.