Microsoft Sentinel icon

Microsoft Sentinel

Consume the Sentinel API

Actions31

Incident → Get Comment

AI-generated

Overview

This node operation retrieves a specific comment from an incident in Microsoft Sentinel. It is useful for scenarios where you need to access detailed information about a particular comment associated with a security incident, such as for auditing, investigation, or reporting purposes. For example, a security analyst might use this operation to fetch and review a comment made by a team member on a specific incident to understand the context or actions taken.

Use Case Examples

  1. Retrieve a comment by its UUID from a given incident to review analyst notes.
  2. Fetch a specific comment to display in a custom dashboard or report.

Properties

Name Meaning
Sentinel Instance The Microsoft Sentinel instance to use, specified by subscription ID, resource group, and workspace name, or by providing a valid Azure Portal/Management URL.
Incident ID The UUID of the incident from which to retrieve the comment.
Comment ID The UUID of the specific comment to retrieve from the incident.
Options Additional options for the request, including whether to simplify the response.

Output

JSON

  • id - The unique identifier of the comment.
  • message - The content of the comment.
  • createdBy - Information about the user who created the comment.
  • createdTimeUtc - The timestamp when the comment was created.
  • lastModifiedTimeUtc - The timestamp when the comment was last modified.

Dependencies

  • An OAuth2 API credential for Microsoft Sentinel is required to authenticate requests.

Troubleshooting

  • Ensure the Incident ID and Comment ID are valid UUIDs; invalid IDs will cause errors.
  • Verify that the Sentinel Instance is correctly specified and accessible with the provided credentials.
  • If the response is empty or unexpected, check the 'Simplify' option to toggle between raw and simplified data formats.

Links

Discussion