Microsoft Sentinel icon

Microsoft Sentinel

Consume the Sentinel API

Actions31

Incident → Get Entities

AI-generated

Overview

This node operation retrieves entities related to a specific incident in Microsoft Sentinel. It is useful for security analysts and incident responders who need to gather detailed information about entities such as IPs, hosts, and accounts associated with a security incident. For example, after identifying an incident, a user can fetch all related entities to understand the scope and impact of the incident.

Use Case Examples

  1. Fetch entities related to a given incident ID to analyze potential threats and affected assets.
  2. Use the operation to automate incident investigation workflows by integrating entity data into a security dashboard.

Properties

Name Meaning
Sentinel Instance The Microsoft Sentinel instance to use, specified by subscription ID, resource group, and workspace name, or selected from a list.
Incident ID The UUID of the incident for which to retrieve related entities.
Options Additional options to customize the request, such as whether to split results into individual items.

Output

JSON

  • entities - List of entities related to the specified incident, such as IP addresses, hosts, and accounts.

Dependencies

  • Requires an API key credential for Microsoft Sentinel OAuth2 authentication to access the Sentinel API.

Troubleshooting

  • Ensure the Incident ID is a valid UUID; invalid IDs will cause request failures.
  • Verify the Sentinel Instance details are correctly formatted and accessible.
  • If the API returns errors, check that the OAuth2 credentials are valid and have sufficient permissions.

Links

Discussion